docs(security): migrate fallback contact to hikyo.app

.github/workflows/docs.yml

@@ -112,7 +112,7 @@ jobs:
           DOCS_ATTEMPTS: "12"
           DOCS_CACHE_BUST: ${{ github.sha }}
           DOCS_RETRY_DELAY_SECONDS: "10"
-        run: ./scripts/ci/check-docs-live.sh https://hikyo.app security@developwent.io
+        run: ./scripts/ci/check-docs-live.sh https://hikyo.app security@hikyo.app
       - name: Verify Storybook published under /storybook/
         env:
           CACHE_BUST: ${{ github.sha }}

.github/workflows/release.yml

@@ -151,9 +151,9 @@ jobs:
         run: |
           ./scripts/ci/check-fallback-channel-test.sh \
             release/repository/fallback-channel-test.json \
-            security@developwent.io
+            security@hikyo.app
           ./scripts/ci/check-docs-live.sh \
-            https://hikyo.app security@developwent.io
+            https://hikyo.app security@hikyo.app
 
       - name: Validate candidate for GoReleaser
         env:

.github/workflows/reliability.yml

@@ -401,7 +401,7 @@ jobs:
         run: >-
           ./scripts/ci/check-fallback-channel-test.sh
           release/repository/fallback-channel-test.json
-          security@developwent.io
+          security@hikyo.app
       - name: Surface fallback-channel degradation
         if: failure()
         env:

SECURITY.md

@@ -16,7 +16,7 @@ reporter is still credited unless they opt out.
 
 1. Report privately through [GitHub Private Vulnerability Reporting](https://github.com/Hikyo-Org/Hikyo/security/advisories/new).
 2. If GitHub is unavailable or you cannot access it, email
-   [security@developwent.io](mailto:security@developwent.io). This address is
+   [security@hikyo.app](mailto:security@hikyo.app). This address is
    fallback-only so reports stay consolidated in the primary channel.
 3. Include affected versions, impact, reproduction steps, and any known
    mitigations. Do not include secrets that are not needed to reproduce the
@@ -43,7 +43,7 @@ they opt out.
 
 The default embargo is 90 days from the report itself. The clock never waits on
 acknowledgement. If acknowledgement is missed, reporters are expressly invited
-to escalate through `security@developwent.io`; disclosure at the 90-day deadline
+to escalate through `security@hikyo.app`; disclosure at the 90-day deadline
 is legitimate regardless of maintainer response.
 
 The embargo may be shortened by mutual agreement. Active exploitation

docs/site/public/.well-known/security.txt

@@ -1,5 +1,5 @@
 Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new
-Contact: mailto:security@developwent.io
+Contact: mailto:security@hikyo.app
 Expires: 2027-08-09T00:00:00Z
 Preferred-Languages: en
 Canonical: https://hikyo.app/.well-known/security.txt

release/repository/fallback-channel-test-2026-08-13.json

@@ -0,0 +1,9 @@
+{
+  "schema": "hikyo.dev/fallback-channel-test/v1",
+  "address": "security@developwent.io",
+  "status": "passed",
+  "sent_at": "2026-08-13T07:09:44Z",
+  "received_at": "2026-08-13T07:09:54Z",
+  "message_id_sha256": "b032cf8e5302aa852305cf9aadd8b24cfeb8b6e90811b918692a7c5c8b6a8093",
+  "note": "Externally sent self-report received through the fallback channel; exact Message-ID retained only as its SHA-256 hash."
+}

release/repository/fallback-channel-test.json

@@ -1,9 +1,9 @@
 {
   "schema": "hikyo.dev/fallback-channel-test/v1",
-  "address": "security@developwent.io",
-  "status": "passed",
-  "sent_at": "2026-08-13T07:09:44Z",
-  "received_at": "2026-08-13T07:09:54Z",
-  "message_id_sha256": "b032cf8e5302aa852305cf9aadd8b24cfeb8b6e90811b918692a7c5c8b6a8093",
-  "note": "Externally sent self-report received through the fallback channel; exact Message-ID retained only as its SHA-256 hash."
+  "address": "security@hikyo.app",
+  "status": "pending",
+  "sent_at": null,
+  "received_at": null,
+  "message_id_sha256": null,
+  "note": "Canonical fallback contact migrated to security@hikyo.app. New-address intake is owner-reported only; actual transport and acknowledgment evidence remains pending. Historical August metadata is preserved separately and does not qualify this address."
 }

scripts/ci/check-docs-live_test.sh

@@ -84,13 +84,13 @@ case "$url" in
 		fi
 		printf '%s\n' \
 			'Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new' \
-			'Contact: mailto:security@developwent.io' \
+			'Contact: mailto:security@hikyo.app' \
 			"Expires: $expires" \
 			'Canonical: https://hikyo.app/.well-known/security.txt'
 		;;
 	*/security/)
 		printf '%s\n' 'The default embargo is 90 days from the report itself.' \
-			'security@developwent.io' \
+			'security@hikyo.app' \
 			'Reports are acknowledged within 7 days.' \
 			'critical: 14 days;' 'high: 30 days;' \
 			'medium or low: the next scheduled release.' \
@@ -166,11 +166,11 @@ chmod +x "$fixture_dir/curl"
 
 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io
+	https://hikyo.app security@hikyo.app
 
 for origin in http://hikyo.app https://hikyo.app.example.invalid https://hikyo.app/docs; do
 	if CURL_BIN="$fixture_dir/curl" "$repo_root/scripts/ci/check-docs-live.sh" \
-		"$origin" security@developwent.io >"$fixture_dir/origin-refusal.log" 2>&1; then
+		"$origin" security@hikyo.app >"$fixture_dir/origin-refusal.log" 2>&1; then
 		printf 'live docs fixture failed: noncanonical origin %s was accepted\n' "$origin" >&2
 		exit 1
 	fi
@@ -179,64 +179,64 @@ done
 
 if FAKE_NO_MX=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: fallback domain without MX was accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_BAD_MX_DATA=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: malformed numeric MX data was accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_EXPIRED=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: elapsed security.txt expiry was accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_STALE_GOVERNANCE=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: stale served governance was accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_STALE_BASE=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: stale /hikyo/ assets were accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_BAD_ASSET_TYPE=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: HTML stylesheet response was accepted\n' >&2
 	exit 1
 fi
 
 if FAKE_STALE_PWA=1 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: stale PWA manifest was accepted\n' >&2
 	exit 1
 fi
 
 if ! FAKE_STALE_ONCE=1 FAKE_STALE_MARKER="$fixture_dir/stale-once" \
 	DOCS_ATTEMPTS=2 DOCS_RETRY_DELAY_SECONDS=0 CURL_BIN="$fixture_dir/curl" \
 	"$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: transient stale deployment was not retried\n' >&2
 	exit 1
 fi
 
 if FAKE_STALE_BASE=1 DOCS_ATTEMPTS=2 DOCS_RETRY_DELAY_SECONDS=0 \
 	CURL_BIN="$fixture_dir/curl" "$repo_root/scripts/ci/check-docs-live.sh" \
-	https://hikyo.app security@developwent.io >/dev/null 2>&1; then
+	https://hikyo.app security@hikyo.app >/dev/null 2>&1; then
 	printf 'live docs fixture failed: persistent stale deployment was accepted\n' >&2
 	exit 1
 fi
@@ -250,7 +250,7 @@ for mutation in FAKE_WRONG_CANONICAL FAKE_STALE_SUPPORT FAKE_STALE_CAPABILITIES
 	esac
 	if env "$mutation=1" CURL_BIN="$fixture_dir/curl" \
 		"$repo_root/scripts/ci/check-docs-live.sh" \
-		https://hikyo.app security@developwent.io >"$fixture_dir/failure.log" 2>&1; then
+		https://hikyo.app security@hikyo.app >"$fixture_dir/failure.log" 2>&1; then
 		printf 'live docs fixture failed: %s was accepted\n' "$mutation" >&2
 		exit 1
 	fi
@@ -260,7 +260,7 @@ done
 for path in / /security/ /_astro/landing.css /pwa-192x192.png; do
 	if FAKE_REDIRECT_PATH="$path" CURL_BIN="$fixture_dir/curl" \
 		"$repo_root/scripts/ci/check-docs-live.sh" \
-		https://hikyo.app security@developwent.io >"$fixture_dir/failure.log" 2>&1; then
+		https://hikyo.app security@hikyo.app >"$fixture_dir/failure.log" 2>&1; then
 		printf 'live docs fixture failed: redirect from %s was accepted\n' "$path" >&2
 		exit 1
 	fi

scripts/ci/check-fallback-channel-test_test.sh

@@ -9,7 +9,7 @@ trap 'rm -rf "$fixture_dir"' EXIT HUP INT TERM
 cat >"$fixture_dir/passed.json" <<'EOF'
 {
   "schema": "hikyo.dev/fallback-channel-test/v1",
-  "address": "security@developwent.io",
+  "address": "security@hikyo.app",
   "status": "passed",
   "sent_at": "2026-08-01T10:00:00Z",
   "received_at": "2026-08-01T10:05:00Z",
@@ -19,13 +19,24 @@ EOF
 
 HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/passed.json" security@developwent.io
+	"$fixture_dir/passed.json" security@hikyo.app
+
+# A valid receipt for the former mailbox must not qualify the new address.
+sed 's/security@hikyo.app/security@developwent.io/' \
+	"$fixture_dir/passed.json" >"$fixture_dir/mismatched.json"
+if HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \
+	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
+	"$fixture_dir/mismatched.json" security@hikyo.app >"$fixture_dir/mismatched.log" 2>&1; then
+	printf 'fallback fixture failed: receipt for a different mailbox was accepted\n' >&2
+	exit 1
+fi
+grep -F 'evidence address does not match fallback address' "$fixture_dir/mismatched.log" >/dev/null
 
 sed 's/"status": "passed"/"status": "pending"/' \
 	"$fixture_dir/passed.json" >"$fixture_dir/pending.json"
 if HIKYO_FALLBACK_TEST_NOW=2026-08-10T00:00:00Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/pending.json" security@developwent.io >/dev/null 2>&1; then
+	"$fixture_dir/pending.json" security@hikyo.app >/dev/null 2>&1; then
 	printf 'fallback fixture failed: pending test was accepted\n' >&2
 	exit 1
 fi
@@ -36,7 +47,7 @@ sed \
 	"$fixture_dir/passed.json" >"$fixture_dir/stale.json"
 if HIKYO_FALLBACK_TEST_NOW=2026-08-09T00:00:00Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/stale.json" security@developwent.io >/dev/null 2>&1; then
+	"$fixture_dir/stale.json" security@hikyo.app >/dev/null 2>&1; then
 	printf 'fallback fixture failed: stale test was accepted\n' >&2
 	exit 1
 fi
@@ -45,7 +56,7 @@ sed 's/2026-08-01T10:05:00Z/2026-08-09T10:01:00Z/' \
 	"$fixture_dir/passed.json" >"$fixture_dir/late.json"
 if HIKYO_FALLBACK_TEST_NOW=2026-08-10T00:00:00Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/late.json" security@developwent.io >/dev/null 2>&1; then
+	"$fixture_dir/late.json" security@hikyo.app >/dev/null 2>&1; then
 	printf 'fallback fixture failed: receipt outside acknowledgement window was accepted\n' >&2
 	exit 1
 fi
@@ -54,10 +65,10 @@ fi
 # time as well as the date so a calendar-day calculation cannot extend custody.
 HIKYO_FALLBACK_TEST_NOW=2026-11-02T10:05:00Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/passed.json" security@developwent.io
+	"$fixture_dir/passed.json" security@hikyo.app
 if HIKYO_FALLBACK_TEST_NOW=2026-11-02T10:05:01Z \
 	"$repo_root/scripts/ci/check-fallback-channel-test.sh" \
-	"$fixture_dir/passed.json" security@developwent.io >"$fixture_dir/stale-boundary.log" 2>&1; then
+	"$fixture_dir/passed.json" security@hikyo.app >"$fixture_dir/stale-boundary.log" 2>&1; then
 	printf 'fallback fixture failed: receipt older than 93 days was accepted\n' >&2
 	exit 1
 fi

scripts/ci/check-oss-policy.sh

@@ -79,7 +79,7 @@ require_text "$repo_root/TRADEMARK.md" 'Permission is required to offer a hosted
 require_text "$repo_root/TRADEMARK.md" 'does not limit the code freedoms granted by the Mozilla Public License 2.0.'
 require_text "$repo_root/CONTRIBUTING.md" 'Every commit in a pull request must carry a Developer Certificate of Origin'
 require_text "$repo_root/SECURITY.md" 'Do not report vulnerabilities in public issues.'
-require_text "$repo_root/SECURITY.md" 'security@developwent.io'
+require_text "$repo_root/SECURITY.md" 'security@hikyo.app'
 require_text "$repo_root/SECURITY.md" 'acknowledged within 7 days'
 require_text "$repo_root/SECURITY.md" 'critical: 14 days;'
 require_text "$repo_root/SECURITY.md" 'high: 30 days;'
@@ -115,7 +115,7 @@ touch_icon="$repo_root/docs/site/public/apple-touch-icon.png"
 require_file "$favicon"
 require_file "$touch_icon"
 require_text "$security_txt" 'Contact: https://github.com/Hikyo-Org/Hikyo/security/advisories/new'
-require_text "$security_txt" 'Contact: mailto:security@developwent.io'
+require_text "$security_txt" 'Contact: mailto:security@hikyo.app'
 require_text "$security_txt" 'Expires:'
 require_text "$security_txt" 'Canonical: https://hikyo.app/.well-known/security.txt'
 source_expires=$(awk -F ': ' '$1 == "Expires" {print $2}' "$security_txt")
@@ -129,7 +129,7 @@ if (!Number.isFinite(expiry) || expiry <= Date.now()) process.exit(1);
 
 fallback_evidence="$repo_root/release/repository/fallback-channel-test.json"
 require_file "$fallback_evidence"
-require_text "$fallback_evidence" '"address": "security@developwent.io"'
+require_text "$fallback_evidence" '"address": "security@hikyo.app"'
 
 require_text "$repo_root/SUPPORT.md" 'Hikyo supports exactly one version: the latest patch release of the latest minor'
 require_text "$repo_root/SUPPORT.md" 'end-of-life on the same day a new minor is released'
@@ -211,7 +211,7 @@ cmp "$touch_icon" "$site_root/apple-touch-icon.png" >/dev/null || {
 }
 
 require_text "$site_root/security/index.html" 'The default embargo is 90 days from the report itself.'
-require_text "$site_root/security/index.html" 'security@developwent.io'
+require_text "$site_root/security/index.html" 'security@hikyo.app'
 require_text "$site_root/security/index.html" 'Latest patch release of the latest minor'
 require_text "$site_root/security/index.html" 'All older stable releases'
 require_text "$site_root/support/index.html" 'Hikyo supports exactly one version'