From 945401d5450df766f968eaee04781e69e5cf816e Mon Sep 17 00:00:00 2001 From: drjones Date: Wed, 20 May 2026 16:03:20 -0700 Subject: [PATCH] docs: add SECURITY.md --- SECURITY.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..22832e7 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Scope + +This repository is maintained for authorized, lawful work only. Do not use code, firmware, payloads, scripts, or documentation from this project against systems, accounts, devices, networks, cards, readers, or services you do not own or do not have explicit permission to test. + +## Reporting + +Report security concerns privately to the maintainer. Do not open public issues containing live credentials, tokens, private captures, card data, target identifiers, exploit chains, or sensitive logs. + +## Secrets And Data + +- Do not commit `.env` files, API keys, Wi-Fi credentials, session cookies, private keys, dumps, captures, or personal data. +- Firmware binaries and captured artifacts must include provenance notes and SHA256 hashes before release. +- Generated dependency folders and build output belong outside Git unless there is a documented reason. + +## Maintainer Rule + +If a change increases misuse risk, narrows safety boundaries, or weakens provenance, it must be rejected or quarantined until documented.