security: require app-level vulnerability proofs
sethforprivacy committed
Aug 3, 2026 at 07:22 UTC
42019d8644c7bcc8cb2ecfe08a5419becb3acd72
1 file changed
+12
-1
docs/SECURITY.md
+12
-1
@@ -30,13 +30,24 @@ security channel, so reports will not be missed.
30
### What to include
31
32
- A clear description of the issue and its security impact.
33
-- Step-by-step reproduction, ideally with a proof of concept.
33
+- A working proof of concept is required. It must run directly against Cake
34
+ Wallet itself, using a release build or locally built version, and demonstrate
35
+ the reported behavior and security impact. Standalone Python code,
36
+ mathematical examples, or simulations that only reproduce the theory without
37
+ exercising Cake Wallet do not satisfy this requirement.
38
+- Step-by-step reproduction instructions.
39
- Affected platforms (iOS, Android, macOS, Linux, Windows) and app version.
40
- Affected wallet types / chains, if applicable.
41
- Any relevant logs, addresses, or transaction IDs (for on-chain issues).
42
43
If you used AI tooling to find or write up the report, please say so.
44
45
+### Communication expectations
46
+
47
+AI should not be used to generate comments when communicating with maintainers
48
+and other contributors. Comments are expected to be written by humans. Comments
49
+that are believed to be written by AI may be moderated.
50
+
51
## Our commitment (safe harbor)
52
53
We consider security research conducted in good faith under this policy to be