feat(security): user security contact and escalation path (#392) #918

2026-06-19T01:41:07Z

PlasticDigits commented

2026-06-19 01:41:07 +00:00

(Migrated from gitlab.com)

Summary

Adds a published security contact and escalation path for users who see suspicious trades, unexpected balances, or misleading UI states (SEC-A07, #392).

SECURITY.md at repo root: email (contact@ceramicliberty.com), GitLab security report template link, responsible disclosure guidance, and a 48–72 hour initial acknowledgement window.
.gitlab/issue_templates/security_report.md: public GitLab issue template with security label and structured fields.
dApp footer: LegalFooterNotice links Report suspicious activity to the GitLab security template (legalCopy.ts constants).
Docs/skills cross-links: docs/security-model.md, docs/frontend.md, docs/qa-onboarding.md, skills/AGENTS_SECURITY_CONTACT.md.

Acceptance checklist (#392)

Criterion	Verification	Result
`SECURITY.md` at repo root with contact + response window	`test -f SECURITY.md && grep -E 'contact@ceramicliberty.com	48–72 hours' SECURITY.md`
Public GitLab security issue template	`test -f .gitlab/issue_templates/security_report.md`	PASS
Security contact reachable from dApp	`LegalFooterNotice` footer link; unit test `LegalFooterNotice.test.tsx`	PASS
Response window explicitly stated	`SECURITY.md` § Response window; `SECURITY_RESPONSE_WINDOW` in `legalCopy.ts`	PASS
Responsible disclosure guidance	`SECURITY.md` § Responsible disclosure (`Do not` publish exploit details before contact)	PASS

Third-party verification

# Repo policy + template
test -f SECURITY.md
test -f .gitlab/issue_templates/security_report.md
grep -q '48–72 hours' SECURITY.md
grep -q 'contact@ceramicliberty.com' SECURITY.md
grep -q 'Do not' SECURITY.md

# Frontend unit test
export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH"
bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:unit -- src/components/legal/__tests__/LegalFooterNotice.test.tsx

Manual (optional): make dev → open any page → footer (desktop) or mobile legal strip → click Report suspicious activity → GitLab new-issue page with the security_report template pre-selected.

GitLab issue #392 (left open; merge does not auto-close per workflow)

## Summary Adds a published security contact and escalation path for users who see suspicious trades, unexpected balances, or misleading UI states (SEC-A07, #392). - **`SECURITY.md`** at repo root: email (`contact@ceramicliberty.com`), GitLab security report template link, responsible disclosure guidance, and a **48–72 hour** initial acknowledgement window. - **`.gitlab/issue_templates/security_report.md`**: public GitLab issue template with `security` label and structured fields. - **dApp footer**: `LegalFooterNotice` links **Report suspicious activity** to the GitLab security template (`legalCopy.ts` constants). - Docs/skills cross-links: `docs/security-model.md`, `docs/frontend.md`, `docs/qa-onboarding.md`, `skills/AGENTS_SECURITY_CONTACT.md`. ## Acceptance checklist (#392) | Criterion | Verification | Result | |-----------|--------------|--------| | `SECURITY.md` at repo root with contact + response window | `test -f SECURITY.md && grep -E 'contact@ceramicliberty.com|48–72 hours' SECURITY.md` | PASS | | Public GitLab security issue template | `test -f .gitlab/issue_templates/security_report.md` | PASS | | Security contact reachable from dApp | `LegalFooterNotice` footer link; unit test `LegalFooterNotice.test.tsx` | PASS | | Response window explicitly stated | `SECURITY.md` § Response window; `SECURITY_RESPONSE_WINDOW` in `legalCopy.ts` | PASS | | Responsible disclosure guidance | `SECURITY.md` § Responsible disclosure (`Do not` publish exploit details before contact) | PASS | ## Third-party verification ```bash # Repo policy + template test -f SECURITY.md test -f .gitlab/issue_templates/security_report.md grep -q '48–72 hours' SECURITY.md grep -q 'contact@ceramicliberty.com' SECURITY.md grep -q 'Do not' SECURITY.md # Frontend unit test export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH" bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:unit -- src/components/legal/__tests__/LegalFooterNotice.test.tsx ``` **Manual (optional):** `make dev` → open any page → footer (desktop) or mobile legal strip → click **Report suspicious activity** → GitLab new-issue page with the `security_report` template pre-selected. ## Related - GitLab issue #392 (left open; merge does not auto-close per workflow)

PlasticDigits commented

2026-06-19 01:43:10 +00:00

(Migrated from gitlab.com)

Security review — MR !918

Commit reviewed: 8bc9972aa51886ff340f784fd96e97cf9fc7ec0a
Scope: SECURITY.md, GitLab security_report issue template, LegalFooterNotice footer link (legalCopy.ts constants), docs/skills cross-links, unit test, footer link CSS.

Outcome: FINDINGS: 0 medium+

Summary

Reviewed added/modified paths for injection, authn/authz bypass, secret leakage, XSS/SSRF, unsafe deserialization, and permission-boundary mistakes. This MR adds published security-contact policy and a static footer link to the GitLab security issue template.

Controls verified:

SECURITY_REPORT_ISSUE_URL and SECURITY_CONTACT_EMAIL are compile-time constants (no env/user input).
Footer anchor uses target="_blank" with rel="noopener noreferrer" (tabnabbing mitigated).
No new runtime dependencies, API handlers, contract/indexer logic, or CSP/connect-src changes.
React renders static strings; no dangerouslySetInnerHTML or dynamic href construction.

Prior review threads: none on this MR; no re-reporting required.

Inline threads: none (no medium+ findings).

## Security review — MR !918 **Commit reviewed:** `8bc9972aa51886ff340f784fd96e97cf9fc7ec0a` **Scope:** `SECURITY.md`, GitLab `security_report` issue template, `LegalFooterNotice` footer link (`legalCopy.ts` constants), docs/skills cross-links, unit test, footer link CSS. **Outcome:** `FINDINGS: 0` medium+ ### Summary Reviewed added/modified paths for injection, authn/authz bypass, secret leakage, XSS/SSRF, unsafe deserialization, and permission-boundary mistakes. This MR adds published security-contact policy and a static footer link to the GitLab security issue template. **Controls verified:** - `SECURITY_REPORT_ISSUE_URL` and `SECURITY_CONTACT_EMAIL` are compile-time constants (no env/user input). - Footer anchor uses `target="_blank"` with `rel="noopener noreferrer"` (tabnabbing mitigated). - No new runtime dependencies, API handlers, contract/indexer logic, or CSP/connect-src changes. - React renders static strings; no `dangerouslySetInnerHTML` or dynamic `href` construction. **Prior review threads:** none on this MR; no re-reporting required. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-06-19 01:53:40 +00:00

(Migrated from gitlab.com)

mentioned in commit fcc9eaf601

mentioned in commit fcc9eaf6014cc54768ec99161c0b8ff2049299d5