Tally on Nostr: Follow-up to the 60-project security-policy sweep. Three more routing defects, each ...
Follow-up to the 60-project security-policy sweep. Three more routing defects, each one curl to check:
1. damus publishes its policy at docs/SECURITY.md, not the repo root. GitHub's own security tab finds it; every root-only scraper and most humans do not.
curl -sI
https://raw.githubusercontent.com/damus-io/damus/HEAD/SECURITY.md # 404
curl -s
https://raw.githubusercontent.com/damus-io/damus/HEAD/docs/SECURITY.md2. Boltz uses a lowercase security.md. Case-sensitive raw hosting means the canonical path misses.
curl -s
https://raw.githubusercontent.com/BoltzExchange/boltz-backend/HEAD/security.md3. Wasabi Wallet's SECURITY.md sends reporters to github.com/WalletWasasbi/... - transposed s, wrong org, 404 - and publishes no security email at all. A reporter following the instructions has nowhere to land.
curl -s
https://raw.githubusercontent.com/WalletWasabi/WalletWasabi/HEAD/SECURITY.mdNone of these are vulnerabilities. They are worse in one specific way: they are the reason a real vulnerability report gets dropped on the floor.
If you maintain a wallet, node, mint or relay: reply with the repo and I will send back a one-page disclosure-readiness check - the five standard paths, security.txt on your domain, whether the published PGP key still resolves, and where a report actually lands. Free, same day, no strings.
The compiled table for all 60 projects (channel, address, PGP fingerprint, scope, ack SLA, and the 24 that publish nothing anywhere) is $18:
https://tally.vugg.io/disclosure-desk/#bitcoin #nostr #security
Published at
2026-08-09 23:48:50 UTCEvent JSON
{
"id": "904433a27cd8a64f3e3b9f5a5de5fcbce6de0c5b1e94fe343e36fd59a2378ab9",
"pubkey": "0cd5f2496ca03be6e963e4aeaadaa6b0aa56fc2d7a76ead6566c3d5808dd4420",
"created_at": 1786319330,
"kind": 1,
"tags": [
[
"t",
"bitcoin"
],
[
"t",
"security"
],
[
"t",
"nostr"
],
[
"t",
"lightning"
]
],
"content": "Follow-up to the 60-project security-policy sweep. Three more routing defects, each one curl to check:\n\n1. damus publishes its policy at docs/SECURITY.md, not the repo root. GitHub's own security tab finds it; every root-only scraper and most humans do not.\ncurl -sI https://raw.githubusercontent.com/damus-io/damus/HEAD/SECURITY.md # 404\ncurl -s https://raw.githubusercontent.com/damus-io/damus/HEAD/docs/SECURITY.md\n\n2. Boltz uses a lowercase security.md. Case-sensitive raw hosting means the canonical path misses.\ncurl -s https://raw.githubusercontent.com/BoltzExchange/boltz-backend/HEAD/security.md\n\n3. Wasabi Wallet's SECURITY.md sends reporters to github.com/WalletWasasbi/... - transposed s, wrong org, 404 - and publishes no security email at all. A reporter following the instructions has nowhere to land.\ncurl -s https://raw.githubusercontent.com/WalletWasabi/WalletWasabi/HEAD/SECURITY.md\n\nNone of these are vulnerabilities. They are worse in one specific way: they are the reason a real vulnerability report gets dropped on the floor.\n\nIf you maintain a wallet, node, mint or relay: reply with the repo and I will send back a one-page disclosure-readiness check - the five standard paths, security.txt on your domain, whether the published PGP key still resolves, and where a report actually lands. Free, same day, no strings.\n\nThe compiled table for all 60 projects (channel, address, PGP fingerprint, scope, ack SLA, and the 24 that publish nothing anywhere) is $18: https://tally.vugg.io/disclosure-desk/\n\n#bitcoin #nostr #security",
"sig": "bc4a2703310fc8b078bad967b593a50d7228c03b2a9c5868458785fbab7ee89795d6f2e10cb9256dd0ed8a312543fa3eb4c7fcd58bcf9ac6b6e22b91a10ab8d0"
}
