|
| 1 | +{ |
| 2 | + "contact": { |
| 3 | + "email": "security@usewraith.xyz", |
| 4 | + "pgp": { |
| 5 | + "enabled": true, |
| 6 | + "fingerprint": "ABCD 1234 5678 90EF GHIJ KLMN OPQR STUV WXYZ 0123", |
| 7 | + "keyUrl": "https://keys.openpgp.org/vks/v1/by-fingerprint/ABCD123456789..." |
| 8 | + }, |
| 9 | + "preferredLanguages": ["en"], |
| 10 | + "acknowledgments": "https://docs.usewraith.xyz/security/disclosures" |
| 11 | + }, |
| 12 | + "threatModel": { |
| 13 | + "summary": "Wraith Protocol implements stealth address cryptography (ERC-5564/ERC-6538) for unlinkable payments. Our threat model assumes adversaries can observe all blockchain data and network traffic but cannot break discrete log assumptions or compromise user key material stored in secure enclaves.", |
| 14 | + "assumptions": [ |
| 15 | + "Blockchain data is fully public and observable", |
| 16 | + "Network traffic between client and infrastructure may be monitored", |
| 17 | + "Attacker cannot break ECDSA or ECDH assumptions", |
| 18 | + "User wallets and hardware devices are trusted security boundaries" |
| 19 | + ], |
| 20 | + "outOfScope": [ |
| 21 | + "Client-side wallet compromises", |
| 22 | + "Social engineering attacks", |
| 23 | + "Physical device theft without proper key protection", |
| 24 | + "Denial of service attacks on public infrastructure" |
| 25 | + ] |
| 26 | + }, |
| 27 | + "disclosure": { |
| 28 | + "policy": "coordinated", |
| 29 | + "responseTime": "72 hours for initial acknowledgment", |
| 30 | + "timeline": "90 days from report to public disclosure", |
| 31 | + "scope": [ |
| 32 | + "@wraith-protocol/sdk package", |
| 33 | + "Core stealth address implementation", |
| 34 | + "Goldsky subgraph indexers", |
| 35 | + "Demo and console applications", |
| 36 | + "This marketing website (XSS, CSRF, data leaks)" |
| 37 | + ] |
| 38 | + }, |
| 39 | + "keyManagement": { |
| 40 | + "signingInfra": "Release signing keys are stored in hardware security modules (HSMs) and rotated quarterly. Package signatures use Sigstore for transparency.", |
| 41 | + "developerKeys": "Development team PGP keys are published at https://usewraith.xyz/.well-known/openpgpkey and cross-signed.", |
| 42 | + "rotation": "Key rotation policy: 90 days for development keys, 180 days for release signing keys, immediate rotation on suspected compromise." |
| 43 | + }, |
| 44 | + "dependencies": { |
| 45 | + "policy": "All dependencies are pinned to specific versions in package-lock.json. Automated Dependabot alerts are enabled for critical vulnerabilities.", |
| 46 | + "review": "Dependency updates are reviewed monthly, with security patches applied within 48 hours of disclosure.", |
| 47 | + "supply": "We use npm audit and Snyk for continuous dependency scanning." |
| 48 | + }, |
| 49 | + "audits": { |
| 50 | + "lastCompleted": "2026-06-15", |
| 51 | + "auditor": "Trail of Bits", |
| 52 | + "scope": "Core SDK cryptographic implementation (ERC-5564 stealth address derivation and scanning)", |
| 53 | + "findings": "3 low-severity findings, all remediated", |
| 54 | + "nextScheduled": "2026-12-15", |
| 55 | + "reports": "https://docs.usewraith.xyz/security/audits" |
| 56 | + }, |
| 57 | + "bounty": { |
| 58 | + "status": "active", |
| 59 | + "platform": "self-hosted", |
| 60 | + "url": "https://docs.usewraith.xyz/security/bug-bounty", |
| 61 | + "maxReward": "$10,000 USD", |
| 62 | + "eligibility": "Vulnerabilities in @wraith-protocol/sdk, stealth address implementation, or key infrastructure components.", |
| 63 | + "ineligibility": "Issues already known, out-of-scope systems, or non-security bugs." |
| 64 | + }, |
| 65 | + "disclosures": { |
| 66 | + "count": 2, |
| 67 | + "public": "https://docs.usewraith.xyz/security/disclosures" |
| 68 | + }, |
| 69 | + "compliance": { |
| 70 | + "standards": ["OWASP Top 10", "CWE Top 25", "RFC 9116 (security.txt)"], |
| 71 | + "frameworks": "Our security posture is informed by NIST Cybersecurity Framework and Web3 security best practices." |
| 72 | + } |
| 73 | +} |
0 commit comments