2f6950e44e
Both are prerequisites for any external review programme, and one of them was already promised by our live security.txt to a file that did not exist. SECURITY.md states the scope, the response times we hold ourselves to, and three things we would rather a reviewer heard from us than discovered: there has been no third-party audit, every validator is operated by the Foundation, and the post-quantum guarantee is at anchor heights rather than on every block. AUDITS.md opens by saying we have had no third-party audit, and keeps that first line until it stops being true.
46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
# Security policy
|
||
|
||
## Reporting a vulnerability
|
||
|
||
Report privately to **security@aere.network**. Do not open a public issue for a security problem.
|
||
|
||
- We aim to acknowledge within **72 hours**.
|
||
- We will tell you whether we consider the report in scope, and why, within **7 days**.
|
||
- We will not pursue legal action against good-faith research conducted under this policy.
|
||
- Public credit on [AUDITS.md](https://aere.network/AUDITS.md) unless you ask to stay anonymous.
|
||
|
||
The canonical, always-current policy is <https://aere.network/security>, and the machine-readable
|
||
pointer is <https://aere.network/.well-known/security.txt>.
|
||
|
||
## In scope
|
||
|
||
- Consensus for AERE chain **2800**: the QBFT implementation, the post-quantum anchor certificate,
|
||
and the post-quantum layers on consensus messages.
|
||
- The post-quantum precompiles (`0x0AE1`–`0x0AE5`) and the code that dispatches to them.
|
||
- Node RPC surfaces exposed publicly.
|
||
- Solidity contracts deployed by the Foundation.
|
||
|
||
## Out of scope
|
||
|
||
- Denial of service by traffic volume against public endpoints.
|
||
- Findings that require physical access to Foundation hardware or a Foundation private key.
|
||
- Reports generated by automated scanners with no demonstrated impact on this chain.
|
||
|
||
## What we will tell you honestly
|
||
|
||
- **There has been no third-party security audit of this project.** See
|
||
[AUDITS.md](https://aere.network/AUDITS.md). Everything verified so far is us checking ourselves,
|
||
which is weaker, and we do not describe it as an audit.
|
||
- **All validators are operated by the Foundation.** The number of independent parties who would
|
||
have to agree to halt this chain is one. No amount of cryptography changes that number, and a
|
||
report pointing at the consequences of that fact is in scope and welcome.
|
||
- **The post-quantum guarantee is at anchor heights**, not on every block: from block 13,014,000,
|
||
every 32nd block carries a Falcon-512 certificate under the block hash, requiring at least six
|
||
valid seals out of nine from block 14,961,456. Blocks between anchors rest on ECDSA. We correct
|
||
over-claims publicly when we find them, and we have done so before.
|
||
|
||
## Fixes
|
||
|
||
When a report leads to a fix, we publish the finding, the fix, and the window during which the
|
||
issue was live — including anything we chose not to fix, and why.
|