diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d78abf6c1..60a62f46d 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -112,7 +112,7 @@ jobs: DOCS_ATTEMPTS: "12" DOCS_CACHE_BUST: ${{ github.sha }} DOCS_RETRY_DELAY_SECONDS: "10" - run: ./scripts/ci/check-docs-live.sh https://hikyo.app security@developwent.io + run: ./scripts/ci/check-docs-live.sh https://hikyo.app security@hikyo.app - name: Verify Storybook published under /storybook/ env: CACHE_BUST: ${{ github.sha }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 446d8a382..57d223d74 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -151,9 +151,9 @@ jobs: run: | ./scripts/ci/check-fallback-channel-test.sh \ release/repository/fallback-channel-test.json \ - security@developwent.io + security@hikyo.app ./scripts/ci/check-docs-live.sh \ - https://hikyo.app security@developwent.io + https://hikyo.app security@hikyo.app - name: Validate candidate for GoReleaser env: diff --git a/.github/workflows/reliability.yml b/.github/workflows/reliability.yml index e8ae48475..a341b7209 100644 --- a/.github/workflows/reliability.yml +++ b/.github/workflows/reliability.yml @@ -401,7 +401,7 @@ jobs: run: >- ./scripts/ci/check-fallback-channel-test.sh release/repository/fallback-channel-test.json - security@developwent.io + security@hikyo.app - name: Surface fallback-channel degradation if: failure() env: diff --git a/SECURITY.md b/SECURITY.md index f4dc15a0c..864df5c64 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,7 +16,7 @@ reporter is still credited unless they opt out. 1. Report privately through [GitHub Private Vulnerability Reporting](https://github.com/Hikyo-Org/Hikyo/security/advisories/new). 2. If GitHub is unavailable or you cannot access it, email - [security@developwent.io](mailto:security@developwent.io). This address is + [security@hikyo.app](mailto:security@hikyo.app). This address is fallback-only so reports stay consolidated in the primary channel. 3. Include affected versions, impact, reproduction steps, and any known mitigations. Do not include secrets that are not needed to reproduce the @@ -43,7 +43,7 @@ they opt out. The default embargo is 90 days from the report itself. The clock never waits on acknowledgement. If acknowledgement is missed, reporters are expressly invited -to escalate through `security@developwent.io`; disclosure at the 90-day deadline +to escalate through `security@hikyo.app`; disclosure at the 90-day deadline is legitimate regardless of maintainer response. The embargo may be shortened by mutual agreement. Active exploitation diff --git a/docs/site/public/.well-known/security.txt b/docs/site/public/.well-known/security.txt index f8149ad47..552be70e5 100644 --- a/docs/site/public/.well-known/security.txt +++ b/docs/site/public/.well-known/security.txt @@ -1,5 +1,5 @@ Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new -Contact: mailto:security@developwent.io +Contact: mailto:security@hikyo.app Expires: 2027-08-09T00:00:00Z Preferred-Languages: en Canonical: https://hikyo.app/.well-known/security.txt diff --git a/release/repository/fallback-channel-test-2026-08-13.json b/release/repository/fallback-channel-test-2026-08-13.json new file mode 100644 index 000000000..f312d7a5f --- /dev/null +++ b/release/repository/fallback-channel-test-2026-08-13.json @@ -0,0 +1,9 @@ +{ + "schema": "hikyo.dev/fallback-channel-test/v1", + "address": "security@developwent.io", + "status": "passed", + "sent_at": "2026-08-13T07:09:44Z", + "received_at": "2026-08-13T07:09:54Z", + "message_id_sha256": "b032cf8e5302aa852305cf9aadd8b24cfeb8b6e90811b918692a7c5c8b6a8093", + "note": "Externally sent self-report received through the fallback channel; exact Message-ID retained only as its SHA-256 hash." +} diff --git a/release/repository/fallback-channel-test.json b/release/repository/fallback-channel-test.json index f312d7a5f..3e1661e60 100644 --- a/release/repository/fallback-channel-test.json +++ b/release/repository/fallback-channel-test.json @@ -1,9 +1,9 @@ { "schema": "hikyo.dev/fallback-channel-test/v1", - "address": "security@developwent.io", - "status": "passed", - "sent_at": "2026-08-13T07:09:44Z", - "received_at": "2026-08-13T07:09:54Z", - "message_id_sha256": "b032cf8e5302aa852305cf9aadd8b24cfeb8b6e90811b918692a7c5c8b6a8093", - "note": "Externally sent self-report received through the fallback channel; exact Message-ID retained only as its SHA-256 hash." + "address": "security@hikyo.app", + "status": "pending", + "sent_at": null, + "received_at": null, + "message_id_sha256": null, + "note": "Canonical fallback contact migrated to security@hikyo.app. New-address intake is owner-reported only; actual transport and acknowledgment evidence remains pending. Historical August metadata is preserved separately and does not qualify this address." } diff --git a/scripts/ci/check-docs-live_test.sh b/scripts/ci/check-docs-live_test.sh index 036e9d981..fecc6ec72 100755 --- a/scripts/ci/check-docs-live_test.sh +++ b/scripts/ci/check-docs-live_test.sh @@ -84,13 +84,13 @@ case "$url" in fi printf '%s\n' \ 'Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new' \ - 'Contact: mailto:security@developwent.io' \ + 'Contact: mailto:security@hikyo.app' \ "Expires: $expires" \ 'Canonical: https://hikyo.app/.well-known/security.txt' ;; */security/) printf '%s\n' 'The default embargo is 90 days from the report itself.' \ - 'security@developwent.io' \ + 'security@hikyo.app' \ 'Reports are acknowledged within 7 days.' \ 'critical: 14 days;' 'high: 30 days;' \ 'medium or low: the next scheduled release.' \ @@ -166,11 +166,11 @@ chmod +x "$fixture_dir/curl" CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io + https://hikyo.app security@hikyo.app for origin in http://hikyo.app https://hikyo.app.example.invalid https://hikyo.app/docs; do if CURL_BIN="$fixture_dir/curl" "$repo_root/scripts/ci/check-docs-live.sh" \ - "$origin" security@developwent.io >"$fixture_dir/origin-refusal.log" 2>&1; then + "$origin" security@hikyo.app >"$fixture_dir/origin-refusal.log" 2>&1; then printf 'live docs fixture failed: noncanonical origin %s was accepted\n' "$origin" >&2 exit 1 fi @@ -179,49 +179,49 @@ done if FAKE_NO_MX=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: fallback domain without MX was accepted\n' >&2 exit 1 fi if FAKE_BAD_MX_DATA=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: malformed numeric MX data was accepted\n' >&2 exit 1 fi if FAKE_EXPIRED=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: elapsed security.txt expiry was accepted\n' >&2 exit 1 fi if FAKE_STALE_GOVERNANCE=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: stale served governance was accepted\n' >&2 exit 1 fi if FAKE_STALE_BASE=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: stale /hikyo/ assets were accepted\n' >&2 exit 1 fi if FAKE_BAD_ASSET_TYPE=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: HTML stylesheet response was accepted\n' >&2 exit 1 fi if FAKE_STALE_PWA=1 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: stale PWA manifest was accepted\n' >&2 exit 1 fi @@ -229,14 +229,14 @@ fi if ! FAKE_STALE_ONCE=1 FAKE_STALE_MARKER="$fixture_dir/stale-once" \ DOCS_ATTEMPTS=2 DOCS_RETRY_DELAY_SECONDS=0 CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: transient stale deployment was not retried\n' >&2 exit 1 fi if FAKE_STALE_BASE=1 DOCS_ATTEMPTS=2 DOCS_RETRY_DELAY_SECONDS=0 \ CURL_BIN="$fixture_dir/curl" "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >/dev/null 2>&1; then + https://hikyo.app security@hikyo.app >/dev/null 2>&1; then printf 'live docs fixture failed: persistent stale deployment was accepted\n' >&2 exit 1 fi @@ -250,7 +250,7 @@ for mutation in FAKE_WRONG_CANONICAL FAKE_STALE_SUPPORT FAKE_STALE_CAPABILITIES esac if env "$mutation=1" CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >"$fixture_dir/failure.log" 2>&1; then + https://hikyo.app security@hikyo.app >"$fixture_dir/failure.log" 2>&1; then printf 'live docs fixture failed: %s was accepted\n' "$mutation" >&2 exit 1 fi @@ -260,7 +260,7 @@ done for path in / /security/ /_astro/landing.css /pwa-192x192.png; do if FAKE_REDIRECT_PATH="$path" CURL_BIN="$fixture_dir/curl" \ "$repo_root/scripts/ci/check-docs-live.sh" \ - https://hikyo.app security@developwent.io >"$fixture_dir/failure.log" 2>&1; then + https://hikyo.app security@hikyo.app >"$fixture_dir/failure.log" 2>&1; then printf 'live docs fixture failed: redirect from %s was accepted\n' "$path" >&2 exit 1 fi diff --git a/scripts/ci/check-fallback-channel-test_test.sh b/scripts/ci/check-fallback-channel-test_test.sh index 742627cd2..043548339 100755 --- a/scripts/ci/check-fallback-channel-test_test.sh +++ b/scripts/ci/check-fallback-channel-test_test.sh @@ -9,7 +9,7 @@ trap 'rm -rf "$fixture_dir"' EXIT HUP INT TERM cat >"$fixture_dir/passed.json" <<'EOF' { "schema": "hikyo.dev/fallback-channel-test/v1", - "address": "security@developwent.io", + "address": "security@hikyo.app", "status": "passed", "sent_at": "2026-08-01T10:00:00Z", "received_at": "2026-08-01T10:05:00Z", @@ -19,13 +19,24 @@ EOF HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/passed.json" security@developwent.io + "$fixture_dir/passed.json" security@hikyo.app + +# A valid receipt for the former mailbox must not qualify the new address. +sed 's/security@hikyo.app/security@developwent.io/' \ + "$fixture_dir/passed.json" >"$fixture_dir/mismatched.json" +if HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \ + "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ + "$fixture_dir/mismatched.json" security@hikyo.app >"$fixture_dir/mismatched.log" 2>&1; then + printf 'fallback fixture failed: receipt for a different mailbox was accepted\n' >&2 + exit 1 +fi +grep -F 'evidence address does not match fallback address' "$fixture_dir/mismatched.log" >/dev/null sed 's/"status": "passed"/"status": "pending"/' \ "$fixture_dir/passed.json" >"$fixture_dir/pending.json" if HIKYO_FALLBACK_TEST_NOW=2026-08-10T00:00:00Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/pending.json" security@developwent.io >/dev/null 2>&1; then + "$fixture_dir/pending.json" security@hikyo.app >/dev/null 2>&1; then printf 'fallback fixture failed: pending test was accepted\n' >&2 exit 1 fi @@ -36,7 +47,7 @@ sed \ "$fixture_dir/passed.json" >"$fixture_dir/stale.json" if HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/stale.json" security@developwent.io >/dev/null 2>&1; then + "$fixture_dir/stale.json" security@hikyo.app >/dev/null 2>&1; then printf 'fallback fixture failed: stale test was accepted\n' >&2 exit 1 fi @@ -45,7 +56,7 @@ sed 's/2026-08-01T10:05:00Z/2026-08-09T10:01:00Z/' \ "$fixture_dir/passed.json" >"$fixture_dir/late.json" if HIKYO_FALLBACK_TEST_NOW=2026-08-10T00:00:00Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/late.json" security@developwent.io >/dev/null 2>&1; then + "$fixture_dir/late.json" security@hikyo.app >/dev/null 2>&1; then printf 'fallback fixture failed: receipt outside acknowledgement window was accepted\n' >&2 exit 1 fi @@ -54,10 +65,10 @@ fi # time as well as the date so a calendar-day calculation cannot extend custody. HIKYO_FALLBACK_TEST_NOW=2026-11-02T10:05:00Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/passed.json" security@developwent.io + "$fixture_dir/passed.json" security@hikyo.app if HIKYO_FALLBACK_TEST_NOW=2026-11-02T10:05:01Z \ "$repo_root/scripts/ci/check-fallback-channel-test.sh" \ - "$fixture_dir/passed.json" security@developwent.io >"$fixture_dir/stale-boundary.log" 2>&1; then + "$fixture_dir/passed.json" security@hikyo.app >"$fixture_dir/stale-boundary.log" 2>&1; then printf 'fallback fixture failed: receipt older than 93 days was accepted\n' >&2 exit 1 fi diff --git a/scripts/ci/check-oss-policy.sh b/scripts/ci/check-oss-policy.sh index a73fbd679..fea12a5d2 100755 --- a/scripts/ci/check-oss-policy.sh +++ b/scripts/ci/check-oss-policy.sh @@ -79,7 +79,7 @@ require_text "$repo_root/TRADEMARK.md" 'Permission is required to offer a hosted require_text "$repo_root/TRADEMARK.md" 'does not limit the code freedoms granted by the Mozilla Public License 2.0.' require_text "$repo_root/CONTRIBUTING.md" 'Every commit in a pull request must carry a Developer Certificate of Origin' require_text "$repo_root/SECURITY.md" 'Do not report vulnerabilities in public issues.' -require_text "$repo_root/SECURITY.md" 'security@developwent.io' +require_text "$repo_root/SECURITY.md" 'security@hikyo.app' require_text "$repo_root/SECURITY.md" 'acknowledged within 7 days' require_text "$repo_root/SECURITY.md" 'critical: 14 days;' require_text "$repo_root/SECURITY.md" 'high: 30 days;' @@ -115,7 +115,7 @@ touch_icon="$repo_root/docs/site/public/apple-touch-icon.png" require_file "$favicon" require_file "$touch_icon" require_text "$security_txt" 'Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new' -require_text "$security_txt" 'Contact: mailto:security@developwent.io' +require_text "$security_txt" 'Contact: mailto:security@hikyo.app' require_text "$security_txt" 'Expires:' require_text "$security_txt" 'Canonical: https://hikyo.app/.well-known/security.txt' source_expires=$(awk -F ': ' '$1 == "Expires" {print $2}' "$security_txt") @@ -129,7 +129,7 @@ if (!Number.isFinite(expiry) || expiry <= Date.now()) process.exit(1); fallback_evidence="$repo_root/release/repository/fallback-channel-test.json" require_file "$fallback_evidence" -require_text "$fallback_evidence" '"address": "security@developwent.io"' +require_text "$fallback_evidence" '"address": "security@hikyo.app"' require_text "$repo_root/SUPPORT.md" 'Hikyo supports exactly one version: the latest patch release of the latest minor' require_text "$repo_root/SUPPORT.md" 'end-of-life on the same day a new minor is released' @@ -211,7 +211,7 @@ cmp "$touch_icon" "$site_root/apple-touch-icon.png" >/dev/null || { } require_text "$site_root/security/index.html" 'The default embargo is 90 days from the report itself.' -require_text "$site_root/security/index.html" 'security@developwent.io' +require_text "$site_root/security/index.html" 'security@hikyo.app' require_text "$site_root/security/index.html" 'Latest patch release of the latest minor' require_text "$site_root/security/index.html" 'All older stable releases' require_text "$site_root/support/index.html" 'Hikyo supports exactly one version'