Skip to content

docs(security): add SECURITY.md #179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jjramirezn wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(security): add SECURITY.md #179

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Security policy

## Report a vulnerability

Report security issues here:

**https://peanut.me/en/help/security-disclosure**

That page is the current policy. Machine-readable contact details are at
[`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt).
Comment on lines +9 to +10

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Reference the repository’s canonical policy source.

The PR objective identifies mono/product/security.md as the single source of truth, but this file only points to the public disclosure page. Add an explicit reference to the canonical file to reduce policy drift.

Proposed fix 
-That page is the current policy. Machine-readable contact details are at
+That page is the current policy. The canonical source is
+[`mono/product/security.md`](mono/product/security.md). Machine-readable contact details are at
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
That page is the current policy. Machine-readable contact details are at
[`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt).
That page is the current policy. The canonical source is
[`mono/product/security.md`](mono/product/security.md). Machine-readable contact details are at
[`/.well-known/security.txt`](https://peanut.me/.well-known/security.txt).
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY.md` around lines 9 - 10, Update SECURITY.md to explicitly reference
the repository’s canonical policy source at mono/product/security.md, while
retaining the existing link to the public security.txt disclosure page.


We read every report.

## Scope

In scope:

- The Peanut app and website (peanut.me)
- The Peanut API
- The smart contracts behind Peanut accounts

Out of scope:

- Partner systems (identity verification, banking, card issuing)
- Scanner output with no demonstrated impact
- Denial of service and volumetric testing
- Social engineering
- Anything that needs physical access to another person's unlocked device
Comment on lines +26 to +28

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Preserve the complete out-of-scope wording.

The current disclosure page also excludes spam and issues requiring another person’s fingerprint or face; both exclusions are missing here. Keep this copy aligned with the linked policy. (peanut.me)

Proposed fix 
-- Denial of service and volumetric testing
+- Denial of service, spam, and volumetric testing
...
-- Anything that needs physical access to another person's unlocked device
+- Anything requiring physical access to another person's unlocked device or their fingerprint or face
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Denial of service and volumetric testing
- Social engineering
- Anything that needs physical access to another person's unlocked device
- Denial of service, spam, and volumetric testing
- Social engineering
- Anything requiring physical access to another person's unlocked device or their fingerprint or face
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY.md` around lines 26 - 28, Update the out-of-scope list in
SECURITY.md to preserve the complete policy wording by adding exclusions for
spam and issues requiring another person’s fingerprint or face, while keeping
the existing exclusions unchanged and aligned with the linked disclosure policy.


## Rewards

Rewards are discretionary. There is no fixed payout schedule and no severity
tiers. Older pages elsewhere on the internet describe a Peanut bug bounty with
published payout figures. That programme is retired.
Loading