Skip to content

Latest commit

 

History

History
84 lines (58 loc) · 2.66 KB

SECURITY.md

File metadata and controls

84 lines (58 loc) · 2.66 KB

Security Guidelines

This document outlines security best practices for the Adati project.

🔒 Sensitive Files

The following files should NEVER be committed to the repository:

  • key.properties - Android signing configuration
  • *.jks, *.keystore - Android keystore files
  • local.properties - Local Android SDK paths
  • *.p12, *.pem - Certificates and private keys
  • *.mobileprovision - iOS provisioning profiles
  • Any file containing passwords, API keys, or tokens

These files are already listed in .gitignore and .gitattributes for additional protection.

✅ Verification

To verify no sensitive files are tracked in git:

git ls-files | grep -iE "(env|key|secret|password|token|credential)"

This should return nothing. If it returns files, remove them immediately:

git rm --cached <file>
git commit -m "Remove sensitive file"

📱 Android Signing

Keystore Security

  • Never commit your keystore file (.jks or .keystore)
  • Never commit key.properties with real values
  • Store keystore files in a secure, backed-up location
  • Use key.properties.example as a template only

See android/SIGNING.md for detailed signing setup instructions.

🛡️ Best Practices

  1. Review before committing: Always review git status and git diff before committing
  2. Never hardcode secrets: Never hardcode secrets in source code
  3. Rotate credentials: If any secret is exposed, rotate it immediately
  4. Use .gitattributes: Additional protection layer (already configured)
  5. Regular audits: Periodically check for accidentally committed secrets

🚨 If Secrets Are Exposed

If you accidentally commit sensitive information:

  1. Immediately rotate the exposed credentials
  2. Remove from git history using: 
    git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch <file>" \
  --prune-empty --tag-name-filter cat -- --all
    Or use BFG Repo-Cleaner
  3. Force push (coordinate with team first): 
    git push origin --force --all
  4. Notify team members to re-clone the repository

📚 Additional Resources

🤝 Reporting Security Issues

If you discover a security vulnerability, please DO NOT open a public issue. Instead:

  1. Email the maintainer directly
  2. Or create a private security advisory on GitHub

We will respond promptly and work with you to resolve the issue.