Update the security policy to mention repos
What the developer wrote
Authored by Tobin C. Harding
Update the security policy to mention repos
Now that we have crate smashed the repository a bunch the security
policy is a bit stale.
Use repositories in the list of things to apply our security policy to
instead of individual crates. Saves us from the long list of crates
now in this repository.
Also remove the mention of cryptography because now we list repos its
not so relevant.
Adds `rust-bech32` because a bug in address generation could lead to
loss of funds which is explicitly defined as a security issue.
Adds `hex-conservative` because we depend on it in `rust-bitcoin` so
bugs there are bugs here.
What changed, and why it matters
This commit only updates the project's SECURITY.md policy document. It changes the list of covered items from individual Rust crates to whole GitHub repositories, removes a mention of cryptography, and adds two additional repositories (rust-bech32 and hex-conservative) to the security policy. No code, logic, or cryptographic behavior was changed, so there is no security vulnerability or fix in the commit itself.
No action required. Review the updated policy text for accuracy if desired, but the commit introduces no runtime change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a documentation-only edit to SECURITY.md. It replaces a paragraph naming crates (bitcoin, secp256k1, bitcoin_hashes, bitcoin-internals) with a bulleted list of repositories (rust-bitcoin, rust-secp256k1, rust-bech32, hex-conservative). The rationale given in the commit message is that the repository has been ‘crate smashed’ (split into many crates), so listing repositories is more maintainable. The commit also justifies adding rust-bech32 (address-generation bugs can cause loss of funds) and hex-conservative (a dependency of rust-bitcoin). No source code, build scripts, tests, or dependencies were modified.
Changed components
SECURITY.md documentationInspect captured patch +6 / −4
diff --git a/SECURITY.md b/SECURITY.md
index c299816e..307828b9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,9 +1,11 @@
# Security Policy
-This security policy applies to the "core" crates in the rust-bitcoin ecosystem, which are
-`bitcoin`, `secp256k1`, `bitcoin_hashes` and `bitcoin-internals`. These crates deal with
-cryptography and cryptographic algorithms, and as such, are likely locations for security
-vulnerabilities to crop up.
+This security policy applies to the "core" repositories in the rust-bitcoin ecosystem, which are:
+
+* [`rust-bitcoin`](https://github.com/rust-bitcoin/rust-bitcoin)
+* [`rust-secp256k1`](https://github.com/rust-bitcoin/rust-secp256k1)
+* [`rust-bech32`](https://github.com/rust-bitcoin/rust-bech32)
+* [`hex-conservative`](https://github.com/rust-bitcoin/hex-conservative)
As a general rule, an issue is a security vulnerability if it could lead to:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.