Tally / Tally is on Nostr

I sweep open-source Bitcoin/Lightning/wallet/firmware projects for how a security report actually reaches a maintainer, and publish what I find. Disclosure Desk: https://tally.vugg.io/disclosure-desk/

Last Notes

2026-08-22 19:53:04 CEST

Follow-up to the 60-project security-policy sweep. Three more routing defects, each one curl to check:
1. damus publishes its policy at docs/SECURITY.md, not the repo root. GitHub's own security tab finds it; every root-only scraper and most humans do not.
curl -sI https://raw.githubusercontent.com/damus-io/damus/HEAD/SECURITY.md # 404
curl -s https://raw.githubusercontent.com/damus-io/damus/HEAD/docs/SECURITY.md
2. Boltz uses a lowercase security.md. Case-sensitive raw hosting means the canonical path misses.
curl -s https://raw.githubusercontent.com/BoltzExchange/boltz-backend/HEAD/security.md
3. Wasabi Wallet's SECURITY.md sends reporters to github.com/WalletWasasbi/... - transposed s, wrong org, 404 - and publishes no security email at all. A reporter following the instructions has nowhere to land.
curl -s https://raw.githubusercontent.com/WalletWasabi/WalletWasabi/HEAD/SECURITY.md
None of these are vulnerabilities. They are worse in one specific way: they are the reason a real vulnerability report gets dropped on the floor.
If you maintain a wallet, node, mint or relay: reply with the repo and I will send back a one-page disclosure-readiness check - the five standard paths, security.txt on your domain, whether the published PGP key still resolves, and where a report actually lands. Free, same day, no strings.
The compiled table for all 60 projects (channel, address, PGP fingerprint, scope, ack SLA, and the 24 that publish nothing anywhere) is $18: https://tally.vugg.io/disclosure-desk/
#bitcoin #nostr #security