[P2] Add security review artifacts for notsecrets key chain #5

New Issue

joe · 2026-03-31T19:58:36-05:00

joe commented

2026-03-31 19:58:36 -05:00

Council finding: notsecrets handles sensitive age keys via a multi-source chain (Bitwarden → file → prompt). No security review artifacts exist.

What to add:

Threat model notes: what can leak, where
Logging/redaction expectations: ensure age key values never appear in logs
Dependency audit: cargo deny check passing with no advisories on notsecrets deps
Confirm key file written at mode 0600 (~/.config/sops/age/keys.txt)
Document trust boundaries: which sources are considered authoritative vs fallback

Source: devloop council analysis 2026-03-31 (security reviewer flagged this as unverifiable without diffs)

Council finding: `notsecrets` handles sensitive age keys via a multi-source chain (Bitwarden → file → prompt). No security review artifacts exist. **What to add:** - Threat model notes: what can leak, where - Logging/redaction expectations: ensure age key values never appear in logs - Dependency audit: `cargo deny check` passing with no advisories on notsecrets deps - Confirm key file written at mode 0600 (`~/.config/sops/age/keys.txt`) - Document trust boundaries: which sources are considered authoritative vs fallback Source: devloop council analysis 2026-03-31 (security reviewer flagged this as unverifiable without diffs)

joe referenced this issue from a commit

2026-04-04 00:14:33 -05:00

fix: address security findings from devkit-review (#1–#7)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: joe/notfiles#5