docs: real SECURITY.md + restructured README for external visitors - #251
Merged
Conversation
PR #246 (kcw-grunt-patch-1) added SECURITY.md but left it as GitHub's unedited default template — placeholder version numbers (5.1.x/5.0.x) that don't match any real Brainwallet release, and instructional placeholder text ("Use this section to tell people...") never filled in with actual content. Replaced with a real policy: reporting instructions pointing at the verified support channel (brainwallet.co/support, from BWConstants.SUPPORT_WEB_LINK — there's no dedicated security@ email anywhere in this repo, and GitHub's private vulnerability reporting is not enabled for this repo, confirmed via the API), explicit scope (wallet/key-management code in scope, third-party deps and social engineering out of scope), a supported-versions policy matching how this app actually ships (continuous release, latest version only), and a safe harbor statement — all relevant for a wallet app handling real user funds and seed phrases. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ributors The README opened straight into CI badges followed by a raw dump of release notes in inconsistent order (v4.9.0, then v4.8.3, then a jump back to v3.9.0-v3.9.1, v3.6.0, v3.3.1) — no description of what the app actually does beyond the title, no download links, no build/setup instructions, no contributing/security/license pointers. For an actively-developed open-source wallet repo, that's a poor front door for anyone landing here from GitHub search or the Play Store listing. Added, all verified against the actual repo/app rather than assumed: - A real description and feature list - Download links (Play Store id ltd.grunt.brainwallet, verified live; the gruntsoftware/ios sibling repo; brainwallet.co) - Clone/build instructions grounded in the actual submodule setup and local.properties/google-services.json requirements from .circleci/config.yml - Architecture summary (Koin, Compose, Coroutines, native wallet core) matching the real module layout - Testing, Security (linking the new SECURITY.md), Contributing (linking the existing PR template), and License sections Preserved the full existing release-notes content underneath a "Release Notes" heading rather than deleting project history, with a pointer to GitHub Releases/compare views for the current changelog going forward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📱 Description
Supersedes #246, which added
SECURITY.mdbut left it as GitHub's unedited default template (placeholder version numbers, unfilled instructional text). This PR replaces it with a real disclosure policy grounded in this repo's actual support channel, and restructuresREADME.md— previously just a title, CI badges, and a disordered dump of release notes — into a proper front page for an actively-developed open-source wallet repo.Platform
🎯 Type of Change
📋 Changes
New Components Added
brainwallet.co/support(BWConstants.SUPPORT_WEB_LINK— no dedicatedsecurity@email exists anywhere in this repo, and GitHub's private vulnerability reporting is confirmed not enabled for this repo via the API), explicit in/out-of-scope, a supported-versions policy matching how this app actually ships (continuous release, latest version only), and a safe harbor statement.Modifications
ltd.grunt.brainwallet— confirmed live, "Brainwallet®: Get Litecoin"; thegruntsoftware/iossibling repo;brainwallet.co), clone/build instructions grounded in the actual submodule +local.properties/google-services.jsonsetup from.circleci/config.yml, an architecture summary matching the real module layout, and Testing/Security/Contributing/License sections. Preserved all existing release-notes content under a "Release Notes" heading rather than deleting project history, with a pointer to GitHub Releases for the current changelog going forward.Removals
None
📊 Statistics
🧪 Tests Status
🎯 Reviewers
@kcw-grunt, @josikie