3

Security

drjones edited this page 2026-05-20 19:08:56 -07:00

Table of Contents

• Security
• Risk Profile
• Handling Rules
• Review Checklist

Security

Risk Profile

• Hardware/firmware changes can affect physical devices; releases need board verification, recovery notes, and checksums.
• NFC/RFID work must not store card dumps, keys, or personal credential material.

Handling Rules

• Do not commit credentials, tokens, cookies, keys, private logs, captures, card data, or personal data.
• Keep generated dependency trees, copied SDKs, and build output out of Git unless explicitly documented as source.
• For security-sensitive projects, keep docs scoped to authorized lab, research, or defensive maintenance.
• Treat unknown-origin binaries as blocked until provenance is recorded.

Review Checklist

• Search the repository for secrets and private data.
• Confirm dependency sources and upstream license status.
• Confirm generated artifacts are ignored or moved to releases.
• Confirm project-specific safe-use boundaries are written in README and release notes.