Repository navigation
Conversation
#400) * content(opsec): endpoint security tiers and DPRK liveness verification - Add endpoint security device provisioning tiers (managed, VDI, enterprise browser) - Add deepfake liveness verification techniques to DPRK TTP page - Add andrew-chang-gu to contributors.json (username TBD) Co-authored-by: DicksonWu654 <dickson@certik.com> Co-authored-by: andrew-chang-gu <> * chore: fill andrew-chang-gu contributor fields from public LinkedIn profile * Add contributor Andrew Chang-Gu to contributors.json Added new contributor Andrew Chang-Gu with details. --------- Co-authored-by: DicksonWu654 <dickson@certik.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* Add password manager endpoint hardening guide * Tone down password manager hardening guide * Shorten password manager hardening guide * Make wallet secret storage guidance explicit * Remove decorative separators from password manager hardening guide * Fix lint in password manager endpoint guide * Tighten password manager endpoint guide * Shorten password manager endpoint guide * Clarify password manager endpoint guidance * Add password manager endpoint hardening guide * Tone down password manager hardening guide * Shorten password manager hardening guide * Make wallet secret storage guidance explicit * Remove decorative separators from password manager hardening guide * Fix lint in password manager endpoint guide * Tighten password manager endpoint guide * Shorten password manager endpoint guide * Clarify password manager endpoint guidance * Expand password manager hardening scope * Revert "Expand password manager hardening scope" This reverts commit 4bf04d6. * docs: tighten password manager browser guidance --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* Add hardware security key guide * Credit Opsek authors on YubiKey guide * Remove decorative separators from hardware security keys guide * Fix lint in hardware security keys guide * Tighten hardware security keys guide * Move hardware security keys guide to endpoint security * Tighten hardware keys guide metadata * Update hardware-security-keys.mdx * Update hardware-security-keys.mdx * Add hardware security key guide * Credit Opsek authors on YubiKey guide * Remove decorative separators from hardware security keys guide * Fix lint in hardware security keys guide * Tighten hardware security keys guide * Move hardware security keys guide to endpoint security * Tighten hardware keys guide metadata * Add YubiKey-specific setup guidance * docs: tighten hardware key setup guidance * Delete AGENTS.md --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* Add stewards for Incident Management and AI Security fws * sync contributors company
* Add SSH client and key management hardening guide * Remove decorative separators from SSH hardening guide * Fix markdownlint spacing in SSH hardening guide * Tighten SSH hardening guide * Shorten SSH hardening guide * Clarify SSH hardening guidance * Introduce SSH certificates for better key management Added a section on using SSH certificates for improved access management. * Clarify SSH host verification guidance * Fix SSH guide markdown formatting * Finish SSH guide review fixes * Add SSH client and key management hardening guide * Remove decorative separators from SSH hardening guide * Fix markdownlint spacing in SSH hardening guide * Tighten SSH hardening guide * Shorten SSH hardening guide * Clarify SSH hardening guidance * Introduce SSH certificates for better key management Added a section on using SSH certificates for improved access management. * Clarify SSH host verification guidance * Fix SSH guide markdown formatting * Finish SSH guide review fixes * Trim unrelated SSH wordlist entries * Update wordlist.txt * Add reviewers to SSH client hardening guide --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* add github workflow to autmatically upload images to S3 * implement review + deps revamp * Reorganize AWS credentials configuration in workflow * Add --ignore-scripts to install step for supply chain attack mitigation --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* Added MFA overview, and updated contributors file. * Build fix and language updates. * Refine MFA overview and recommendations Revised language for clarity and emphasis on MFA importance. Updated recommendations for MFA methods and highlighted security considerations for passkeys. * Further clarification about passkey storage. --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
Co-authored-by: frameworks-volunteer <jamesbond777bot@duck.com>
* Port cert revisions and add SFC Identity & Accounts
Mirrors the revisions applied in the SEAL-Certs-Template repo (see its
CHANGELOG.md for full detail). Summary:
- sfc-multisig-ops: ms-2.1.2 strengthened from "evaluate" to "implement";
ms-4.1.1 transaction process consolidated 8 to 5 bullets
- sfc-treasury-ops: scope note added; per-actor/per-path exposure limits
(tro-2.1.3) and privileged access / root account management (tro-3.1.5)
added; trusted-parser bullet on tro-4.1.1; various consolidations and
softening (session timeouts, impact thresholds, exposure limits)
- sfc-devops-infrastructure: di-1.1.4 split into process + di-1.1.5 list;
runner hardening on di-3.1.1; network architecture on di-4.1.1; supply
chain mention softened; References section added
- sfc-dns-registrar: dns-3.1.1 slimmed to reference the new Identity &
Accounts cert for account management
- sfc-incident-response: four IR controls consolidated (team roles,
contacts, alerting, drills); header reference to Identity & Accounts
- sfc-identity-accounts (NEW): horizontal cert covering organizational
account management (inventory, phishing-resistant MFA, credential
management, recovery methods, lifecycle, takeover monitoring, third-
party access)
Control IDs are stable; no renames. Baseline text changes do not affect
workbook import (keyed on control ID).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Retire SFC Workspace Security; wire in Identity & Accounts
The old Workspace Security cert drifted far from SEAL's SME (device
management, EDR/MDM, physical/travel security, formal training programs).
Its crypto-relevant content (account inventory, phishing-resistant MFA,
credential management, account lifecycle, takeover monitoring) is now in
the new horizontal Identity & Accounts cert. Generic enterprise IT
coverage is better left to ISO 27001 / SOC 2 / CIS.
- Delete docs/pages/certs/sfc-workspace-security.mdx
- vocs.config.tsx: sidebar updated (add Identity & Accounts, remove
Workspace Security)
- utils/generate-cert-data.js: CERT_ORDER updated so the overview-page
"Export All Certifications" xlsx includes I&A and excludes Workspace
- utils/generate-printable-checklists.js: CERT_META updated so the Print
button generates an I&A checklist and no longer generates one for
Workspace
- components/certified-protocols/CertifiedProtocols.tsx: certTypeToName
map updated (sfc-ida replaces sfc-ws)
- docs/pages/certs/overview.mdx: cert list updated
- docs/pages/certs/index.mdx: cert list updated
- docs/pages/intro/overview-of-each-framework.mdx: cert list updated
The fetched-tags.json and cert-data.json artifacts regenerate at build
time.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Surface control IDs in the control card UI
Control IDs (e.g., ms-2.1.2) are already in the data model and used by
workbook import/export and aria attributes, but were invisible in the
rendered card. Surface them inline next to the title so readers and
reviewers have a stable reference they can cite.
- ControlCard.tsx: render {control.id} before the title with a muted
separator
- control.css: .control-id styled muted, monospace, 0.875em; .control-id-sep
muted, non-bold
No behavioral change; purely additive display.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add per-cert version stamps and central changelog
Protocols that have certified against an earlier version of a cert need
to scope the delta when that cert is revised. Adds explicit versioning
so re-certification decisions are data-driven.
- Per-cert frontmatter fields: version (semver-ish) and revised (ISO
date). Rendered inline near the H1 title: "Revision X.Y · Updated
YYYY-MM-DD · Changelog".
- New page: docs/pages/certs/changelog.mdx aggregating revision history
across all certs with inaugural 2026-04-17 entry covering the
feedback-integration-1.1 changes.
- vocs.config.tsx: Changelog added to sidebar under SEAL Certifications.
All five existing certs stamped at v1.1 (revised 2026-04-17). New
Identity & Accounts cert stamped at v1.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Regenerate build artifacts
- docs/pages/certs/index.mdx: generate-folder-indexes added Changelog row
- utils/fetched-tags.json: tags-fetcher regenerated tag map (added
/certs/changelog entry; workspace-security replaced by
identity-accounts; sectionMappings sort order shuffled)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add ir-2.1.1 threat model to Incident Response
Monitoring coverage is only meaningful if it's pointed at the right
things. The existing IR cert had team structure, contacts, monitoring,
alerting, and playbooks, but no control requiring an explicit threat
picture of protocol operations and external dependencies. This control
closes that gap and anchors the monitoring and playbook controls to a
known threat model.
- Insert new ir-2.1.1 (Threat Model for Protocol Operations) at the
start of Section 2 (Monitoring, Detection & Alerting)
- Existing Section 2 controls shifted: old ir-2.1.1 to ir-2.1.2,
ir-2.1.2 to ir-2.1.3, ir-2.1.3 to ir-2.1.4
- Evidence Tracker count 13 to 14 (template repo only)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Rewrite certs overview to align with program roadmap
The previous overview was written during RFC Phase (ended Dec 31, 2025)
and framed certifications as "proposed" and "being developed." The
framework is now stable, published, and moving into active certification
with accredited firms.
Rewritten to:
- Open with the same framing as the internal program-and-roadmap doc:
code audits don't catch operational failures, certifications target
that gap
- List the six modules (with the new Identity & Accounts and Incident
Response updated to include threat modeling)
- Condense "How Certification Works" into a five-step engagement flow
with EAS attestation
- Replace the RFC Phase section with a plain Program Status summary of
where the program is now
- Trim outdated FAQ items (the "Q1 2026 rollout" question) and update
wording throughout
- Link to the new /certs/changelog page for revision history
Shorter overall; aligned with the roadmap doc without duplicating its
operational detail.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Add back protocol and auditor signup links to certs overview
Previous rewrite dropped these along with the RFC Phase framing. Adding
them back as a tight "Get Involved" section between Program Status and
FAQ.
Both entry points currently point at the same typeform
(securityalliance.typeform.com/CertsAuditor), matching the original
overview page. If protocols and auditors need distinct intake forms
later, the URL can be updated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Integrate PR feedback from template repo review
Mirrors template-repo commits acddf5c, 2d3a777, 5ae8d0f which applied
DicksonWu654's review feedback. Since v1.1 hasn't shipped yet, the
changelog entry for v1.1 is updated to reflect final state rather than
documenting an intra-PR iteration.
- sfc-devops-infrastructure: di-1.1.2 drops the supply-chain
parenthetical (Section 2 already handles supply chain); di-1.1.4 and
di-1.1.5 merged back into a single di-1.1.4 covering both the tool
approval process and the approved-tools list; References section at
the bottom removed (other certs don't carry References, so the
inconsistency wasn't earning its keep)
- sfc-identity-accounts: ida-2.1.1 drops the "(subject to SIM-swap and
interception)" parenthetical; ida-4.1.1 drops the inline "(coordinated
with SFC - Incident Response monitoring)" parenthetical (the trailing
IR coordination bullet still carries that point); "Related certs"
list in the page body removed (cross-refs live inline in each
vertical cert)
- sfc-incident-response: ir-2.1.1 threat model gains a baseline bullet
on identifying single points of failure and highly centralized
components across onchain and offchain layers (cross-chain messaging
providers, oracle providers, critical infrastructure dependencies)
- changelog.mdx: v1.1 entry updated to reflect final merged state;
DevOps control count is now unchanged at 16, workbook compat note
flags the shifted IR Section 2 IDs
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Fix protocol signup typeform URL to CertsWaitlist
Both the protocol and auditor signup links in the certs overview were
pointing at the same auditor form (CertsAuditor). Protocols should
land on the waitlist form (CertsWaitlist) instead. Per PR #459 review
comment from DicksonWu654.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ns alphabetical order in fetched tags (#441)
* Add Attack Surface Overview page with interactive radial threat map Visual security posture dashboard showing 12 attack vectors as a radial diagram. Nodes are color-coded (red/amber/green) by posture state with click-to-toggle and localStorage persistence. Clicking a node opens a detail card with description, attack tags, and framework guide links. Designed for CSOs to quickly assess and communicate security gaps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Mark Attack Surface Overview as dev content Adds dev: true flag to sidebar entry per contributing guidelines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace selection ring with scale + glow effect on selected nodes Selected nodes now scale up 10% and show a soft color-matched glow instead of a detached ring outline. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add GitHub Actions reminder for attack surface threat data changes Posts an automated PR comment when threatData.ts is modified, reminding contributors to include all required fields and verify framework links. Follows the same pattern as the existing vocs-config-reminder workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address Sara first PR feedback item Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address Sara second PR feedback item Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Smooth-scroll detail card into view when a threat node is clicked Clicking a node on the radial map showed the detail card below the map, but on typical viewports the card landed below the fold, so it wasn't obvious anything had happened. Use scrollIntoView with block: "nearest" on the card when it mounts or the selected vector changes, respecting prefers-reduced-motion. Third PR feedback item addressed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Move attack-surface.mdx into intro/ folder and update links Moved the page to sit alongside the other Introduction pages. Updated sidebar link, internal cross-link in how-to-navigate, and component import path to match the new location. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use react-router Link for framework CTA to avoid full page reload The detail card's framework link used a plain <a> tag which caused a full page reload. Switched to react-router-dom's <Link> for client-side navigation, consistent with the rest of the site. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add standard page components to Attack Surface Overview Adds TagProvider, TagFilter, TagList, and ContributeFooter to match the pattern used by all other Introduction pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…annel scope (#445) Clarify that profile labels and platform status indicators are not proof of legitimacy, and state that unsupported platforms should be explicitly identified.
Adds TxScope to monitoring tools and wallet security tools pages. TxScope is a Solana-native pre-signing transaction threat scanner for Squads Protocol multisigs, filling the non-EVM tooling gap noted in the current tools page. Co-authored-by: black <bob@bobby.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Clarify hot vs cold wallet taxonomy * Narrow hot vs cold wallet edits --------- Co-authored-by: welttowelt <welttowelt@users.noreply.github.com>
* Add third party script security page in the frontend web app fw * fix Further Reading link * Fix links in web3-supply-chain-threats.mdx
* weekly cleanup: - sync badges - fix outputs spellchecker - fix outputs linter - sync contributing files - sync tags * Cleanup of the latest PR merged * sync contributor badges with latest PRs * Fix indentation
…dates (#425) Bumps the npm_and_yarn group with 2 updates in the / directory: [dompurify](https://github.com/cure53/DOMPurify) and [flatted](https://github.com/WebReflection/flatted). Updates `dompurify` from 3.3.0 to 3.3.3 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.0...3.3.3) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
- code-signing.mdx: Add GPG key generation, subkeys, YubiKey setup, passphrase management, key backup/recovery - continuous-integration-continuous-deployment.mdx: Add SLSA provenance, SBOM generation, OIDC federation for cloud access - repository-hardening.mdx: Add CODEOWNERS patterns, GitHub Advanced Security (CodeQL, secret scanning, dependency review), security policy template - security-testing.mdx: Add severity thresholds table, Semgrep custom rules, false positive management, coverage and mutation testing
- Update contributors frontmatter: mattaereal as author, scode2277 as reviewer - Replace discontinued keys.mailvelope.com with keyserver.ubuntu.com - Fix CISA link text to match URL (Software Bill of Materials) - Update expired nosemgrep example date to 2027-06-01 - Add note about simplified Semgrep rule example
The search index lives in docs/dist/.vocs/ (a hidden directory). actions/upload-artifact@v4 excludes hidden files by default, so the .vocs directory was missing from the uploaded artifact. This caused the search index to be absent from preview deployments, breaking the native search (/) on all preview URLs. Adding include-hidden-files: true ensures the .vocs directory (and any other hidden assets) are included in the artifact.
* feat: add llms.txt generator + llms-{framework}.txt for all the frameworks we have + changed titles to 2 pages as previously confusing
* Add branch-aware links + better hadle of contributing folder
* fix: making the generator inherit dev:true from parent sidebar blocks
* refactor: restructure llms output with per-page files, folder layout, and tighter routing index
* fix: make branch check stronger
…els (#473) * fix: expand VPN services page with HTTPS vs VPN, metadata, threat models (closes #406) * Update docs/pages/privacy/vpn-services.mdx Co-authored-by: Sara Russo <sararusso984@gmail.com> * refactor: split VPN services into subcategory pages per review feedback Restructure vpn-services.mdx into a vpns/ directory with sub-pages: - overview.mdx: entrance page with intro and links to subsections - https-vs-vpn.mdx: HTTPS vs VPN comparison and metadata gap - attack-surfaces-public-networks.mdx: public Wi-Fi risks - when-to-use-vpn.mdx: threat model decision framework + choosing a VPN - vpn-limitations.mdx: VPN limitations and DNS leaks - vpn-providers-and-tools.mdx: recommended providers, tools, and resources Update vocs.config.tsx with nested sidebar structure for VPN Services. All new pages include outline: deep for subsection navigation. --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com> Co-authored-by: Sara Russo <sararusso984@gmail.com>
…dates (#464) Bumps the npm_and_yarn group with 3 updates in the / directory: [axios](https://github.com/axios/axios), [dompurify](https://github.com/cure53/DOMPurify) and [hono](https://github.com/honojs/hono). Updates `axios` from 1.14.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.14.0...v1.15.0) Updates `dompurify` from 3.3.3 to 3.4.1 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.1) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `hono` from 4.12.12 to 4.12.14 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.12...v4.12.14) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.14 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
sync badges sync indexes sync tags fix spellchecker outputs fix linter outputs Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
Extract §4 (Upgrade Governance) out of data-security-upgrade-checklist
into a standalone DevSecOps page focused on smart-contract upgrade
governance across the full proposal lifecycle. Add an interactive hero
graphic mapping threats onto a 4-stage SDLC, replace raw-markdown
checklists with a stateful ChecklistItem component, and extend the
content with material that consistently fails in practice but rarely
appears on upgrade checklists: invariant suites that run against live
mainnet state, and reproducible onchain calldata verified by CI.
Page: /devsecops/governance-proposal-security
Stages: Plan -> Build and Test -> Review & Audit ->
Propose, Verify Onchain Calldata & Monitor
New components:
- <GovernanceSDLCPipeline /> - SVG pipeline with threat constellations,
click-to-expand detail panel, keyboard nav, loop-back "feeds next
cycle" arrow. Reuses categoryMeta from attack-surface for visual
consistency. Stateless.
- <ChecklistItem title="..."> ... </ChecklistItem> - interactive
labelled checkbox with localStorage-persisted state and
aria-describedby. Replaces every raw markdown "- [ ]" item on the
new page.
Migrations:
- docs/pages/devsecops/data-security-upgrade-checklist.mdx - section 4
removed; page renamed to "Data Security Checklist" (URL preserved).
- docs/pages/devsecops/overview.mdx - dropped duplicate "What's inside
DevSecOps" section; Contents list is the single entry point (8
entries including the new page and Isolation & Sandboxing).
- vocs.config.tsx - sidebar entry added and old Data Security entry
renamed.
- components/index.ts - exports the two new components.
Notable content:
- Stage 2: tests must exercise the actual deployment script, and
fork-tests must execute the proposal's calldata at HEAD before
running the integration + invariant suite.
- Stage 3: internal peer review of the proposal by a non-author
reviewer; audit scope extends to deploy scripts and proposal payloads.
- Stage 4: reproducible calldata built locally + rebuilt in CI,
compared byte-for-byte against what's onchain.
- Real-World Proposal Failures: Wormhole (Feb 2022), Nomad (Aug 2022),
Compound cETH Proposal 117 (Aug 2022), Yearn Finance yUSDT (Apr 2023)
- each framed around a specific SDLC failure mode.
Contributors:
- wrote: quillaudits, dickson, ElliotFriedman
- fact-checked: mattaereal
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
Add a coverage work queue that lists unmitigated threats, undocumented controls, empty frameworks, and Related frameworks links with no shared node. Seed Wallet Security from the pages that actually teach custody and signing. Cross-links to multisig, OpSec, and front-end come from shared controls, not related-to edges.
Seed coercion and duress from the pages that teach wrench-attack defense. Reuse the existing duress threat. Facility, counter-surveillance, and hardware supply-chain stubs stay unmapped. Cross-links to Wallet Security, OpSec, and multisig come from shared controls.
Seed custodial treasury from classification, registration, enhanced controls, and large-transfer verification. Distinct from the protocol multisig. Cross-links to multisig, Wallet Security, and IAM come from shared assets and controls, not related-to.
Reuse the existing hiring-infiltration threat. Add the contributor-to-hire path and continuous remote identity review from the TTP and mitigation pages. Case studies stay unmapped. Cross-links to OpSec, IAM, and Incident Management come from shared controls and the existing DPRK response.
Seed full-disk, hardware-backed keys, TLS/SSH, and cloud KMS custody. Messaging, email, database, file, partition, and volume pages stay unmapped. Disk encryption is not a hardware wallet. Cross-links to OpSec and Infrastructure come from shared devices and cloud nodes.
…#640) Seed default E2EE chat, VPN on untrusted networks, and digital-footprint reduction. Data-removal, financial privacy, privacy OS, and VPN provider catalogs stay unmapped. A VPN is not HTTPS. Discord is not E2EE. Cross-links to Encryption, OpSec, Community, and Physical Security come from shared devices, TLS, channels, and identity separation.
Seed adoption, published recovery address, and whitehat fund return. Not a bug bounty and not a substitute for pause or review. Eligibility checklist and on-chain registration walkthrough stay unmapped. No Nomad incident node. Cross-links to Incident Management, smart contracts, the protocol multisig, and governance come from shared exploit and recovery nodes.
Pack AI Security, ENS, Guides, SSDLC, Threat Modeling, and Vulnerability Disclosure as coherent first seeds. Prompt templates are not a control. ENS resolution is not a signature. A bounty is not Safe Harbor. Product guides, AI browsers, ENS cross-chain, and sourced incidents stay unmapped.
Default view is the multisig job, not every node. All is last. New chips for AI agents, ENS, disclosure, and living threat models. SFC modules are guidance nodes. Map nodes point at them with evaluated-by. Do not copy cert checklist IDs onto map controls. Coverage prints unique undirected related-framework pairs. Certs stay.
…tes (#623) Bumps the pnpm-patch group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.7` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.3` | | [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.7` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.2` | `4.3.3` | Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.2.7 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `react-router-dom` from 7.18.1 to 7.18.3 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom) Updates `sharp` from 0.35.3 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.7 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `tailwindcss` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss) --- updated-dependencies: - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: react-router-dom dependency-version: 7.18.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: tailwindcss dependency-version: 4.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-patch - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pnpm-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions-patch group with 1 update in the / directory: [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials). Updates `aws-actions/configure-aws-credentials` from 6.2.3 to 6.2.4 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@e6de054...cbe3b39) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…eck (#631) * docs(wallet-security): added separate section for dry-run recovery check * docs(wallet-security): update dry-run bullet point in key generation sub section * docs(wallet-security): removed redundant asterisks * docs(wallet-security): minor writing style fixes * docs(wallet-security): implemented changes suggested by frameworks-volunteer * Update intermediates-and-medium-funds.mdx --------- Co-authored-by: Matías Aereal Aeón <388605+mattaereal@users.noreply.github.com>
* docs(supply-chain): add private registries and package mirrors Four pages already recommend running a private registry without explaining it: repository-hardening, security-testing, the dependency-attack runbook, and third-party-script-security. The last of those points at Dependency Awareness "for guidance on vendoring", which that page does not cover. Dependency confusion is named twice across the repository and never explained. Adds a page covering what each arrangement gives a team (pull-through cache, curated repository, vendoring), how registry routing closes dependency confusion, why the registry itself joins the trust base, and the operational failures that remove the properties it was deployed for. Points the four existing mentions at the new page, and splits the third-party-script-security reference so pinning still routes to Dependency Awareness while vendoring routes here. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(supply-chain): narrow the pinning claim, drop second person Address review nits on #627. The dependency confusion section claimed a version pin does not address the attack, which overstated it and contradicted the lockfile-timing paragraph later on the same page. A lockfile with integrity hashes does catch a substitution on later installs; the exposure is the resolution that writes the lock, and a name that was never published publicly the moment an attacker claims it. Also replaces "gives you" with "provides" in the security-testing inbound link, matching the third person the rest of the page uses. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(supply-chain): broaden ecosystem coverage for private registries Address review feedback on PR #627: - add Go and Cargo to namespace reservation and routing sections, with a comparison table (pip, npm, Go, Cargo) for replace-vs-extend resolution config - explain why Solidity dependency confusion differs (Foundry pins by git commit; Hardhat inherits npm behavior) - remove dead Microsoft private-feed link, add Go/Cargo reference links
) * docs(wallet-security): add security best practices for hot wallets * docs(wallet-security): minor acronym fix * docs(wallet-security): implement requested changes. * docs(wallet-security): removed password and minimal autolock bullet points * docs(wallet-security): add password and minimal autolock bullet points * Update sentence case to section header * Remove attribution from cold-vs-hot-wallet.mdx * Remove attribution from for-beginners-and-small-balances.mdx --------- Co-authored-by: Sara Russo <sararusso984@gmail.com>
…up across 1 directory (#655) Bumps the npm_and_yarn group with 1 update in the / directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions-minor group with 3 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup), [orhun/git-cliff-action](https://github.com/orhun/git-cliff-action) and [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials). Updates `pnpm/action-setup` from 6.0.10 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@0977fd9...ea17c68) Updates `orhun/git-cliff-action` from 4.8.0 to 4.9.1 - [Release notes](https://github.com/orhun/git-cliff-action/releases) - [Commits](orhun/git-cliff-action@f50e115...a9a9552) Updates `aws-actions/configure-aws-credentials` from 6.2.4 to 6.3.0 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@cbe3b39...e125382) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: orhun/git-cliff-action dependency-version: 4.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…up across 1 directory (#656) Bumps the npm_and_yarn group with 1 update in the / directory: [sharp](https://github.com/lovell/sharp). Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: bump vocs+waku * chore: pin Node to 24 for CI and dev environments to make have succeeding build
…tes (#658) Bumps the pnpm-minor group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1075.0` | `3.1142.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1075.0` | `3.1142.0` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` | | [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.63.0` | | [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.0.1` | `10.3.5` | Updates `@aws-sdk/client-s3` from 3.1075.0 to 3.1142.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1142.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.1075.0 to 3.1142.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1142.0/lib/lib-storage) Updates `mermaid` from 11.16.1 to 11.17.2 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2) Updates `playwright` from 1.61.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.63.0) Updates `cspell` from 10.0.1 to 10.3.5 - [Release notes](https://github.com/streetsidesoftware/cspell/releases) - [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md) - [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.3.5/packages/cspell) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1142.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-minor - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1142.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-minor - dependency-name: mermaid dependency-version: 11.17.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-minor - dependency-name: playwright dependency-version: 1.63.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pnpm-minor - dependency-name: cspell dependency-version: 10.3.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pnpm-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: rebuild release flow around develop's history + small fix to previous changelog * update v0.0.1 changelog readability
* docs(incident-management): add endpoint compromise runbook The runbooks covered infrastructure and key compromise but not the contributor workstation, which is where infostealer and fake-recruiter intrusions actually land. malware.mdx covers the victim side; this is the responder side. Severity derives from the access tier the user holds rather than the malware family, since access is observable in the first twenty minutes and impact is not. Escalators cover ungated pipelines, sub-threshold signers, and public channel control. The credential revocation table is ordered because the common failures are sequencing errors: rotating an SSH key before killing the live session lets the attacker re-add it, and changing a password before revoking sessions leaves the stolen cookie valid. Containment forks on capability rather than doctrine, and handles the already-powered-off device, which is the state malware.mdx produces. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): close NIST and CISA gaps in endpoint runbook Checked the runbook against SP 800-61r3, SP 800-86, and the CISA incident and vulnerability response playbooks. Four things were missing. Evidence collection now runs in order of volatility per SP 800-86, so a responder holding a live machine knows memory outranks disk rather than working down an unordered list. Eradication is gated on finishing the foothold inventory first, which is the CISA sequencing rule. Rebuilding the laptop while an OAuth grant survives moves the attacker off the device and leaves them in the accounts, and the rebuild destroys the evidence that would have found them. The runbook had no way to close an incident. SP 800-61r3 makes improve a standing function, and the repo's own runbook template asks for a resolution checklist, so there is now a closing section covering the incident log, post-mortem, indicator sharing, and the detection gap. External notification was absent on the responder side even though malware.mdx carries it for victims. Legal owns the decision, but the clock starts at discovery, so it belongs in escalation. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): tighten prose in endpoint runbook The closing section opened by negating ("an incident is not closed because the laptop was rebuilt") and letting the next sentence carry the correction, which is the same rhetorical move the key takeaway already spends. Leads with the claim instead. Also drops a filler "just", replaces an unclear line about evidence surviving "without you" with what the rows actually do, and unpacks "a deadline stays a choice" into plain terms. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): wire endpoint runbook to existing pages The symptoms list describes lures this repo already documents with real message screenshots, but nothing connected the two. Differentiation now routes a suspicious meeting-link domain or fake recruiter task to the DPRK playbook, and a Zoom screen-share request to ELUSIVE COMET, since naming the campaign tells the responder which follow-on accounts to check. Both playbooks link back. ELUSIVE COMET previously ended at the malware playbook, which is victim guidance, leaving no route to the org-side process. External notification points at the communications template and communication strategies, which own wording, cadence, and spokesperson while this runbook only covers the legal clock. Closing the incident points at Lessons Learned for the review questions and blameless format. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): cut vague endorsement from differentiation The paragraph added with the playbook cross-links leaned on "worth" twice in four sentences and closed on a generic recommendation rather than a reason. Says what the screenshots are for and stops there. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): cut repetition from endpoint runbook "A stolen session cookie stays valid until revoked" was stated three times: in the P4/P5 note, in step 4, and in row 1 of the revocation table. Step 4 carried nothing else, since it only pointed at the section immediately below it, so it is gone. Two lines contradicted each other on the same phrase. Quick Reference said access is observable within the first twenty minutes, then twenty lines later said access is least understood during the first twenty minutes. The second now makes its point about defaulting high without re-litigating when access becomes knowable. Step 2 explained the memory tradeoff twice in consecutive paragraphs. General principle first, then the already-powered-off case as a short consequence. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): match heading case to sibling runbooks Six headings were sentence case while the ones inherited from the template were title case, so the file was inconsistent with itself and with all nine sibling runbooks, which title-case step headings too. Claude-Session: https://claude.ai/code/session_01CPQ1FcHGiBKWPd8waT7uGx * docs(incident-management): rework endpoint runbook after review Addresses the steward review on #647 plus a blind cold-read, a fact-check of the external citations, and a repo-wide duplication audit. Citation was wrong. The volatility ordering credited NIST SP 800-86, which never uses the phrase "order of volatility" and puts network connections and login sessions ahead of memory because connections time out. The term is RFC 3227's. Memory still leads here, since a full image captures connections, sessions, and the process table, but that is now stated as the reason rather than dressed up as NIST guidance. Two orderings were backwards. The insider-threat warning sat below the instruction to phone the user, so a responder working top to bottom had already tipped off a suspected DPRK IT worker. The foothold-inventory gate sat seventy lines after the revocation table it was meant to gate. Both moved ahead of what they govern. Session logs are now exported before revocation. Killing sessions can truncate the sign-in records that show where the attacker connected from, and the runbook previously collected them two sections later. Severity drops to P1 and P2. Judging a colleague's access tier from memory at 3am is how a signer gets filed as P3, and the review made the case that broad internal access can outrank a signing key. Unclear access now defaults to P1, and the separate escalator checklist folds into the P1 row. Step 1 splits into an org-side track that needs nothing from the user and a person-side track that does, because the account is the urgent part and the previous order made contact a prerequisite. Adds what to do when the user stays unreachable, which the old text left open after telling responders to keep going. Adds the step that confirms compromise, which the runbook assumed and never described, with a path for unmanaged devices that produce no EDR signal. Insider determination stays with Legal and HR. Overstated claims hedged: cookie survival is identity-provider dependent, Entra revokes on password change; powering off does not erase memory that hibernation and swap files still hold, so image the disk either way; cloud 2FA backup restores the same seed rather than one necessarily stolen. Also: wallet assets must move, not just the session, when a hot wallet is exposed; post-mortem gate follows the template's P1-P3 rather than narrowing it; every bracketed value carries a suggested default and a label, since three different ones all read "[X hours]"; known-clean device is defined where four steps depend on it; headings are sentence case per the style guide, which the sibling runbooks predate. The password manager guide told responders to wipe a device that is "suspected compromised", the opposite first action, which would destroy the evidence this runbook collects. Split from the lost-or-stolen case. * docs(incident-management): match checklist voice to sibling runbooks The runbooks state actions in the imperative and keep items short: "Remove compromised signer", "Rotate all secrets and tokens", and a Prevention section of bare noun phrases. This runbook wrote its action checklists as past participles instead, which read as verification rather than instruction and ran twice as long. Converted the action checklists to the imperative and Prevention to noun phrases, leaving the two that really are verification gates, the revocation confirmation and the return-to-service gate, as participles. Average checklist item is down from 8.8 words to 7.9; siblings sit at 4.1 to 4.4. Also cut eight blocks of prose that justified a decision rather than changing one: the section preamble to Confirming compromise, the restatement of why memory matters, the RFC 3227 note the numbered table already carries, the remark about unassigned owners, and the NIST citation behind Closing the incident, whose point is made by the sentence before it. Prose is 109 lines against 25 to 27 in the siblings. That gap is the revocation reasoning, the containment fork, and the step that confirms compromise; the siblings are shorter partly because they are thinner. * docs(incident-management): re-check sessions after password rotation Review raised that a service with no second factor lets a stolen password open a new session right after the old one is killed. The revocation table only covered OAuth tokens, which session revocation also misses. Row 1 now says to re-check after row 8. * docs(incident-management): say what removes a host foothold Review asked what happens when the attacker has a backdoor on the host. The foothold gating sentence only covered account-side persistence, so nothing stated that network containment and the rebuild are what remove a host foothold, and that rotating credentials does not. * Add steward as reviewer --------- Co-authored-by: Sara Russo <sararusso984@gmail.com>
- fix spellcheck & linter - sync badges - sync indexes and tags - add main ready content to main - fix overview of each framework file
# Conflicts: # docs/pages/config/contributors.json # docs/pages/guides/account-management/discord.mdx # docs/pages/wallet-security/intermediates-and-medium-funds.mdx # utils/fetched-tags.json # vocs.config.ts
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Deploying frameworks with
|
| Latest commit: |
d617641
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7e9fc709.frameworks-573.pages.dev |
| Branch Preview URL: | https://develop.frameworks-573.pages.dev |
Release
|
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR change?
This PR takes all the updates of the last month on the main branch and .org site
Type of change
If applicable
vocs.config.tswith thedev: trueparameterStuck on anything? Just write it here and we're happy to help.