Security

SECURITY.md

Security (Pilot Guardrails)

Non-negotiables

Never commit private keys, tokens, or credentials containing real PII.
Use environment variables for secrets.
Commit .env.example only. Never create or commit a real .env.

Secrets handling

Private keys and API tokens must be provided via environment variables at runtime.
Any local keys generated for development must be written to paths ignored by git (see .gitignore).
Do not paste secrets into issues, PR descriptions, or logs.

PII rules

This repo must not store real person data.
Test credentials must use synthetic subjects (e.g., did:example:... and placeholder names).
If sample payloads are needed, they must be obviously fake and non-identifying.

Safe logging

Default to minimal logs.
Never log:
- full credentials
- decoded claim values
- raw JWT/JWS tokens
- private keys or seed phrases
If debugging verification, log only:
- timestamps/durations
- cryptographic verification success/failure
- credential identifier hashes (non-reversible)

Reporting security issues

Do not open public issues with sensitive details.
If a secret is accidentally committed, rotate it immediately and remove it from git history.

There aren’t any published security advisories