Skip to content

SECURITY_CHECKLIST_ASVS.md

Latest commit

 

History

History
48 lines (35 loc) · 1.72 KB

SECURITY_CHECKLIST_ASVS.md

File metadata and controls

48 lines (35 loc) · 1.72 KB
Raw

Kaspa Pulse Security Checklist - OWASP ASVS Inspired

This is a project-specific checklist for Telegram bot and Rust service security.

Admin Authorization

  • ADMIN_USER_ID and ADMIN_CHAT_ID are configured explicitly in production.
  • ADMIN_CHAT_ID equals ADMIN_USER_ID so administration is private-chat only.
  • Authorization uses callback/message actor_user_id, not chat_id.
  • Sensitive admin actions require one-time confirmation.
  • Confirmation nonces are generated by the operating-system CSPRNG.
  • Confirmation sessions bind actor, chat, message, action, and expiry.
  • Admin actions record both actor_user_id and chat_id in admin_audit_log.

Input Validation

  • Wallet input uses Kaspa address validation.
  • Raw messages are length-limited.
  • Wallet messages reject invisible/control characters.
  • Multi-wallet paste is rejected unless explicitly supported.

Output Encoding

  • User-controlled text is escaped before Telegram HTML parse mode.
  • Logs mask wallet, TXID, and block hash values.

Webhook Security

  • WEBHOOK_SECRET_TOKEN is 32+ characters.
  • WEBHOOK_BIND is 127.0.0.1 behind reverse proxy.
  • Health and metrics endpoints are local-only.
  • Public reverse proxy blocks /metrics, /healthz, and /readyz.

Database Security

  • Runtime uses kaspa_pulse_app, not postgres.
  • Migrations are applied through migration files.
  • Runtime schema ensure is disabled in production.
  • Credentials are rotated after any exposure.

Supply Chain

  • cargo audit passes or advisories are documented.
  • cargo deny check passes.
  • cargo clippy with -D warnings passes.
  • cargo machete passes.
  • cargo test passes.
  • Secret scan passes.