Cartera is a payment wallet simulation. Even as a simulation, we treat security with the same rigor as a production financial system. If you discover a security vulnerability, please report it responsibly.

Do NOT open a public issue for security vulnerabilities.

Instead, use one of these methods:

1. GitHub Security Advisories (Preferred): Report a vulnerability

2. Email: Contact the maintainer directly via their GitHub profile: @omghante

• A description of the vulnerability
• Steps to reproduce
• The potential impact
• Any suggested fixes (optional)

Only the latest version on the main branch receives security updates.

• GPG-Signed Commits: All commits must be GPG signed. Pull requests with unsigned commits are automatically closed.
• Static Analysis: Every PR runs dart analyze with fatal warnings to catch potential security issues at the code level.
• Secret Detection: All PRs and pushes are scanned for accidentally committed secrets, API keys, tokens, and credentials using TruffleHog and custom pattern matching.
• CI/CD Protection: Only maintainers can modify CI/CD workflow files. Non-maintainer changes to .github/ are blocked.

• Dependency Change Gate: PRs from non-maintainers that modify pubspec.yaml or pubspec.lock are flagged and require maintainer review before merge.
• OpenSSF Scorecards: The project is evaluated weekly against OpenSSF security best practices.
• License Compliance: Dependencies with restrictive licenses (GPL, AGPL, SSPL) are blocked.

• Issue Templates Required: Issues without templates are automatically closed to prevent information leakage through unstructured reports.
• PR Templates Required: PRs without the required template are automatically closed.
• Conventional Commits: PR titles must follow Conventional Commits format for clear change tracking.
• Stale Item Cleanup: Inactive issues and PRs are automatically closed to reduce the attack surface of open, unmaintained changes.

We ask that you:

1. Allow us reasonable time to fix the issue before public disclosure.
2. Do not exploit the vulnerability beyond what is necessary to demonstrate it.
3. Do not access, modify, or delete data belonging to other users.
4. Act in good faith to avoid disruption to the project and its users.

We will:

1. Acknowledge your report promptly.
2. Keep you informed about the progress of the fix.
3. Credit you in the security advisory (unless you prefer anonymity).
4. Not pursue legal action against researchers who follow this policy.

• Maintainer: @omghante
• Security Advisories: GitHub Security