Repository navigation

Security remediation from full adversarial audit - #2

Merged

ALENOC merged 75 commits into

masterfrom

security/full-audit-remediation-2026-08-18

Aug 18, 2026

Commits on Aug 18, 2026
- security: enforce strict ElectrumX TOFU pinning
  ALENOC
  committed
  42af3fb
- security: deny Android cleartext traffic by default
  ALENOC
  committed
  3a79cd9
- security: restrict Android verification links and cleartext
  ALENOC
  committed
  aae32d6
- security: harden NFC URI parsing and host validation
  ALENOC
  committed
  b77cf90
- security: remove tracked Android local SDK configuration
  ALENOC
  committed
  397bb1d
- security: ignore all Android local.properties files
  ALENOC
  committed
  bf128a3
- ci: add temporary security remediation gate
  ALENOC
  committed
  d3c9f47
- security: add local transaction fee safety policy
  ALENOC
  committed
  0ce834b
- test: cover malicious fee safety invariants
  ALENOC
  committed
  d6a5d55
- security: stage deterministic remediation patcher
  ALENOC
  committed
  db838dd
- ci: execute deterministic security remediation wave
  ALENOC
  committed
  46920a3
- ci: run remediation patcher from draft PR
  ALENOC
  committed
  c707aa3
- ci: fix literal replacements in remediation patcher
  ALENOC
  committed
  3270816
- ci: rerun corrected deterministic remediation wave
  ALENOC
  committed
  c39251c
- ci: use verified immutable MCP digest for remediation
  ALENOC
  committed
  28c63c8
- ci: align IPFS redirect patch with current source
  ALENOC
  committed
  dcbb305
- ci: keep workflow mutations out of runner push
  ALENOC
  committed
  9511239
- ci: push source-only compiled remediation wave
  ALENOC
  committed
  ec5021e
- security: fail closed auth, network, secrets and fee inputs
  ALENOC
  committed
  6124510
- security: stage financial transaction remediation wave
  ALENOC
  committed
  f168ac5
- ci: run full financial security remediation gate
  ALENOC
  committed
  2f62597
- ops: separate backup encryption key from admin authentication
  ALENOC
  committed
  38cc4a9
- security: pin Qwen invoke workflow dependencies
  ALENOC
  committed
  2f32605
- ci: fix duplicate change-branch assertion in wave2
  ALENOC
  committed
  2ce9e36
- ci: rerun corrected financial security wave
  ALENOC
  committed
  b9fd9f2
- ci: align wave2 send caller with current ViewModel syntax
  ALENOC
  committed
  7dfd1c2
- ci: rerun wave2 with current ViewModel caller syntax
  ALENOC
  committed
  b68542a
- ci: finalize wave2 caller and explicit max accounting
  ALENOC
  committed
  864a643
- ci: execute final wave2 transform and full JVM gate
  ALENOC
  committed
  6ceae8e
- security: verify registry claims against decoded Ravencoin issuance
  ALENOC
  committed
  5657e14
- test: cover registry issuance authenticity rules
  ALENOC
  committed
  de262f5
- test: add backend security regression command
  ALENOC
  committed
  7ebbc53
- ci: align SUN fixture patch with current test implementation
  ALENOC
  committed
  02da3fe
- ci: rerun wave2 with current SUN fixture
  ALENOC
  committed
  116a82c
- ci: diagnose remaining direct wallet broadcast site
  ALENOC
  committed
  c216e1a
- ci: print residual wallet broadcast for final wave2 fix
  ALENOC
  committed
  db6eef4
- ci: include reissue in pre-sign reservation boundary
  ALENOC
  committed
  7f4fc2b
- ci: run complete financial remediation including reissue
  ALENOC
  committed
  a0f16c6
- security: add fail-closed authentication primitive for mnemonic key
  ALENOC
  committed
  bb2d671
- security: expose consensus-decoded raw transaction for registry verification
  ALENOC
  committed
  fefc68c
- security: require semantic on-chain issuance proof for registry notify
  ALENOC
  committed
  cde3da1
- security: stage auth-bound mnemonic reveal migration
  ALENOC
  committed
  44512cb
- security: pin Qwen review workflow dependencies
  ALENOC
  committed
  905aee2
- security: pin Qwen triage action and remove OIDC
  ALENOC
  committed
  3936875
- security: pin scheduled Qwen triage action and remove OIDC
  ALENOC
  committed
  6cd7ac9
- ops: use dedicated backup key and 24h seven-snapshot policy
  ALENOC
  committed
  abdb416
- ops: document dedicated backup encryption configuration
  ALENOC
  committed
  1dd77ed
- ci: enforce explicit internal-backup key during remediation gate
  ALENOC
  committed
  1cf6e51
- security: remove unnecessary Qwen dispatcher OIDC permission
  ALENOC
  committed
  5f061f9
- security: centralize standards-correct BIP39 NFKD seed derivation
  ALENOC
  committed
  2381857
- test: add BIP39 official seed and NFKD regression vectors
  ALENOC
  committed
  aed2479
- security: couple auth-bound reveal with tested BIP39 KDF
  ALENOC
  committed
  9e02ec6
- ci: diagnose final wave2 Kotlin integration errors
  ALENOC
  committed
  259b4bd
- ci: finalize wave2 Kotlin integration fixes
  ALENOC
  committed
  60d6244
- ci: run final wave2 build and regression gate
  ALENOC
  committed
  5058800
- ci: diagnose remaining Android wave2 failures
  ALENOC
  committed
  db7534e
- ci: enforce final explicit-max ViewModel signature
  ALENOC
  committed
  e2de879
- ci: run wave2 v7 final financial gate
  ALENOC
  committed
  4dfcd2a
- ci: fix wave2 security regression test source
  ALENOC
  committed
  4d4c609
- ci: run wave2 v8 with compiling security tests
  ALENOC
  committed
  f62c7df
- security: serialize wallet spends and remove implicit max-send
  ALENOC
  committed
  b86eabe
- ci: inspect backend dependency advisories
  ALENOC
  committed
  74f4f96
- ci: resolve compatible backend dependency versions
  ALENOC
  committed
  85315c7
- security: prepare final auth-bound and legacy migration remediation
  ALENOC
  committed
  4b987b6
- ci: enforce final repository security invariants
  ALENOC
  committed
  f708313
- security: prepare final remediation evidence documents
  ALENOC
  committed
  c537195
- ci: apply and verify final security remediation
  ALENOC
  committed
  aa8643a
- ci: resolve final transitive path-to-regexp advisory
  ALENOC
  committed
  94893c8
- security: make NDEF prefix parsing structurally bounds-safe
  ALENOC
  committed
  1c0a2c3
- ci: rerun final remediation with bounds-safe NDEF parser
  ALENOC
  committed
  2a5d20d
- security: make Android IPFS HTTP client redirect fail-closed
  ALENOC
  committed
  8f4da15
- ci: harden final IPFS and immutable-ref checks
  ALENOC
  committed
  30a3270
- ci: fix final security gate invariant parsers
  ALENOC
  committed
  d225e29
- security: complete auth-bound storage and dependency remediation
  ALENOC
  committed
  9c558e4
- ci: remove one-shot security remediation workflow
  ALENOC
  committed
  963e7a6

Commits

Commits on Aug 18, 2026