From aa71e13662770c606a003a81f99f5948a48d4690 Mon Sep 17 00:00:00 2001 From: drjones Date: Wed, 20 May 2026 15:42:41 -0700 Subject: [PATCH] docs: add SECURITY.md --- SECURITY.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..22832e7 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Scope + +This repository is maintained for authorized, lawful work only. Do not use code, firmware, payloads, scripts, or documentation from this project against systems, accounts, devices, networks, cards, readers, or services you do not own or do not have explicit permission to test. + +## Reporting + +Report security concerns privately to the maintainer. Do not open public issues containing live credentials, tokens, private captures, card data, target identifiers, exploit chains, or sensitive logs. + +## Secrets And Data + +- Do not commit `.env` files, API keys, Wi-Fi credentials, session cookies, private keys, dumps, captures, or personal data. +- Firmware binaries and captured artifacts must include provenance notes and SHA256 hashes before release. +- Generated dependency folders and build output belong outside Git unless there is a documented reason. + +## Maintainer Rule + +If a change increases misuse risk, narrows safety boundaries, or weakens provenance, it must be rejected or quarantined until documented.