Create SECURITY.md for security policy - #246
Closed
kcw-grunt wants to merge 1 commit into
Closed
Conversation
Added a security policy document outlining supported versions and vulnerability reporting.
Contributor
📱 DescriptionThis PR adds a SECURITY.md file to establish a clear security policy for the Brainwallet Android app. The document outlines the project's approach to security vulnerabilities, reporting procedures, and supported versions, enabling users and security researchers to responsibly disclose security issues. Platform
🎯 Type of Change
📋 ChangesNew Components Added
ModificationsNone RemovalsNone 📊 Statistics
🔗 Related Issues
🧪 Tests Status
📸 Screenshots/Videos
🎯 ReviewersDraft Status: This PR is currently in draft mode and ready for review feedback. |
11 tasks
Collaborator
|
Superseded by #251 — filled in the actual security policy content and added a README refresh alongside it. |
kcw-grunt
added a commit
that referenced
this pull request
Jul 22, 2026
) * docs: add SECURITY.md with a real vulnerability disclosure process PR #246 (kcw-grunt-patch-1) added SECURITY.md but left it as GitHub's unedited default template — placeholder version numbers (5.1.x/5.0.x) that don't match any real Brainwallet release, and instructional placeholder text ("Use this section to tell people...") never filled in with actual content. Replaced with a real policy: reporting instructions pointing at the verified support channel (brainwallet.co/support, from BWConstants.SUPPORT_WEB_LINK — there's no dedicated security@ email anywhere in this repo, and GitHub's private vulnerability reporting is not enabled for this repo, confirmed via the API), explicit scope (wallet/key-management code in scope, third-party deps and social engineering out of scope), a supported-versions policy matching how this app actually ships (continuous release, latest version only), and a safe harbor statement — all relevant for a wallet app handling real user funds and seed phrases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: restructure README with a real front page for new visitors/contributors The README opened straight into CI badges followed by a raw dump of release notes in inconsistent order (v4.9.0, then v4.8.3, then a jump back to v3.9.0-v3.9.1, v3.6.0, v3.3.1) — no description of what the app actually does beyond the title, no download links, no build/setup instructions, no contributing/security/license pointers. For an actively-developed open-source wallet repo, that's a poor front door for anyone landing here from GitHub search or the Play Store listing. Added, all verified against the actual repo/app rather than assumed: - A real description and feature list - Download links (Play Store id ltd.grunt.brainwallet, verified live; the gruntsoftware/ios sibling repo; brainwallet.co) - Clone/build instructions grounded in the actual submodule setup and local.properties/google-services.json requirements from .circleci/config.yml - Architecture summary (Koin, Compose, Coroutines, native wallet core) matching the real module layout - Testing, Security (linking the new SECURITY.md), Contributing (linking the existing PR template), and License sections Preserved the full existing release-notes content underneath a "Release Notes" heading rather than deleting project history, with a pointer to GitHub Releases/compare views for the current changelog going forward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * updated the README.md --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: kcw-grunt <mrkerrywashington@icloud.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added a security policy document outlining supported versions and vulnerability reporting.
📱 Description
Platform
🎯 Type of Change
📋 Changes
🔗 Related Issues
🧪 Tests Status
📸 Screenshots/Videos
🎯 Reviewers
@kcw-grunt, @josikie