add SECURITY.md #765

Edu92337 · 2026-01-08T20:05:59Z

Description and Notes

This PR adds a minimal SECURITY.md file following the style of Bitcoin Core, LND, and rust-lightning.

Closes #763

The document provides essential security information:

Vulnerability Reporting: Email contact (security@getfloresta.org) with PGP key fingerprint for encrypted communication
PGP Key Import: Command to import Davidson Souza's PGP key for secure disclosure

This follows the minimal security policy style used by major Bitcoin projects (bitcoin/bitcoin, lightningnetwork/lnd, lightningdevkit/rust-lightning), keeping only essential information without unnecessary details.

How to verify the changes you have done?

Check formatting: View the rendered markdown on GitHub

   # Or locally with a markdown viewer
   grip SECURITY.md

Verify the PGP key link: https://blog.dlsouza.lol/assets/gpg.asc
Test GPG import command:

   gpg --recv-keys "2C8E 0F83 6FD7 DBBB B9E9 B2EF 8996 4EC3 AB22 B2E3"

Contributor Checklist

I've followed the contribution guidelines
I've verified one of the following:
- Confirmed CI passed on my fork (documentation-only change)
I've linked any related issue(s) in the sections above (Missing SECURITY.md #763)
All commits are GPG-signed

moisesPompilio

This SECURITY.md is too long and has too much unnecessary information. I think we need something like what bitcoin core does, here are some links to base it on: https://github.com/bitcoin/bitcoin?tab=security-ov-file#readme https://github.com/lightningdevkit/rust-lightning?tab=security-ov-fil https://github.com/lightningnetwork/lnd?tab=security-ov-file

moisesPompilio · 2026-01-09T13:30:01Z

Please squash the commits.

SECURITY.md

qlrd · 2026-01-09T13:53:02Z

IMO, the security information in Contributing section at README.md should be removed too.

SECURITY.md

moisesPompilio · 2026-01-09T14:15:53Z

IMO, the security information in Contributing section at README.md should be removed too.

I don't think we need to remove this information. Instead, we could change it to reference SECURITY.md. This would make it easier for users reading the README.md to know where to find the SECURITY.md file.

luisschwab · 2026-01-09T15:35:07Z

This SECURITY.md is too long and has too much unnecessary information.

Yes, KISS.

luisschwab

Also, the security email is being switched. See PR #764 and https://github.com/Davidson-Souza/Floresta/blob/07017a32c71d7597548ab0e9edd0daad41a43f47/README.md

Davidson-Souza

ACK 767a932

Davidson-Souza · 2026-01-10T12:04:09Z

Since the document was simplified, please update your PR description with the new approach

JoseSK999

ACK 767a932

JoseSK999 · 2026-01-10T18:40:57Z

We would need to update the security mail at README.md/Community, CONTRIBUTING.md/Security and install.sh

Davidson-Souza · 2026-01-10T18:49:54Z

We would need to update the security mail at README.md/Community, CONTRIBUTING.md/Security and install.sh

README.md/Community was changed by #764. But CONTRIBUTING needs to be changed as well. Should do that in another PR

moisesPompilio · 2026-01-10T20:03:10Z

The SECURITY. md text is good, however you just need to make a change to the project's README.md because it talks about how to report a vulnerability in the community section. The current part needs to redirect to this file here, to indicate that if someone finds a vulnerability they should read the SECURITY.md to know how to report it, so the email and public key part of the person to report to stays in one place.

Davidson-Souza · 2026-01-10T20:16:15Z

@moisesPompilio

The SECURITY. md text is good, however you just need to make a change to the project's README.md because it talks about how to report a vulnerability in the community section. The current part needs to redirect to this file here, to indicate that if someone finds a vulnerability they should read the SECURITY.md to know how to report it, so the email and public key part of the person to report to stays in one place.

Agreed. But maybe we leave this as-is and push another PR fixing README and CONTRIBUTING?

jaoleal · 2026-01-10T21:15:10Z

ACK 767a932

moisesPompilio · 2026-01-10T21:33:35Z

Agreed. But maybe we leave this as-is and push another PR fixing README and CONTRIBUTING?

Hmm, I think a fix afterwards would be strange. Better to do it in this PR, because all these changes would be in one commit which would make it easier to identify through the commit history why the lines were changed.

Edu92337 · 2026-01-10T22:05:29Z

Updated README.md to redirect to SECURITY.md. Now all vulnerability reporting details (email and PGP key) are in a single place as requested.

Davidson-Souza · 2026-01-10T22:06:12Z

@Edu92337 could you also add this to CONTRIBUTING.md?

Add minimal security policy following Bitcoin Core style with: - Vulnerability reporting contact - PGP key fingerprint for secure communication Closes getfloresta#763

Davidson-Souza

re-ACK b2a661e

luisschwab

ACK b2a661e

moisesPompilio · 2026-01-10T22:17:00Z

ACK b2a661e

jaoleal · 2026-01-10T22:26:46Z

ACK b2a661e

moisesPompilio reviewed Jan 8, 2026

View reviewed changes

moisesPompilio added the documentation Improvements or additions to documentation label Jan 8, 2026

moisesPompilio mentioned this pull request Jan 9, 2026

docs: add SECURITY.md #768

Closed

moisesPompilio reviewed Jan 9, 2026

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

qlrd suggested changes Jan 9, 2026

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

qlrd suggested changes Jan 9, 2026

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

SECURITY.md Outdated Show resolved Hide resolved

SECURITY.md Outdated Show resolved Hide resolved

Edu92337 force-pushed the master branch from 1339579 to 2ec2d4c Compare January 9, 2026 14:06

luisschwab reviewed Jan 9, 2026

View reviewed changes

Edu92337 force-pushed the master branch from 2ec2d4c to 767a932 Compare January 10, 2026 00:47

Davidson-Souza previously approved these changes Jan 10, 2026

View reviewed changes

Davidson-Souza requested review from luisschwab, moisesPompilio and qlrd January 10, 2026 18:14

JoseSK999 approved these changes Jan 10, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

Edu92337 dismissed Davidson-Souza’s stale review via 8630fab January 10, 2026 22:04

Edu92337 force-pushed the master branch from 767a932 to 8630fab Compare January 10, 2026 22:04

docs: add SECURITY.md

b2a661e

Add minimal security policy following Bitcoin Core style with: - Vulnerability reporting contact - PGP key fingerprint for secure communication Closes getfloresta#763

Edu92337 force-pushed the master branch from 8630fab to b2a661e Compare January 10, 2026 22:11

Davidson-Souza approved these changes Jan 10, 2026

View reviewed changes

luisschwab approved these changes Jan 10, 2026

View reviewed changes

Davidson-Souza merged commit f9e0ebd into getfloresta:master Jan 10, 2026
9 checks passed

add SECURITY.md #765

add SECURITY.md #765

Conversation

Edu92337 commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description and Notes

How to verify the changes you have done?

Contributor Checklist

Uh oh!

moisesPompilio left a comment

Choose a reason for hiding this comment

Uh oh!

moisesPompilio commented Jan 9, 2026

Uh oh!

Uh oh!

Uh oh!

qlrd commented Jan 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

moisesPompilio commented Jan 9, 2026

Uh oh!

luisschwab commented Jan 9, 2026

Uh oh!

luisschwab left a comment

Choose a reason for hiding this comment

Uh oh!

Davidson-Souza left a comment

Choose a reason for hiding this comment

Uh oh!

Davidson-Souza commented Jan 10, 2026

Uh oh!

JoseSK999 left a comment

Choose a reason for hiding this comment

Uh oh!

JoseSK999 commented Jan 10, 2026

Uh oh!

Davidson-Souza commented Jan 10, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

moisesPompilio commented Jan 10, 2026

Uh oh!

Davidson-Souza commented Jan 10, 2026

Uh oh!

jaoleal commented Jan 10, 2026

Uh oh!

moisesPompilio commented Jan 10, 2026

Uh oh!

Edu92337 commented Jan 10, 2026

Uh oh!

Davidson-Souza commented Jan 10, 2026

Uh oh!

Davidson-Souza left a comment

Choose a reason for hiding this comment

Uh oh!

luisschwab left a comment

Choose a reason for hiding this comment

Uh oh!

moisesPompilio commented Jan 10, 2026

Uh oh!

jaoleal commented Jan 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Edu92337 commented Jan 8, 2026 •

edited

Loading