Skip to content

Security: FreClean/freclean-security

Security

SECURITY.md

Security Policy — FreClean

This is FreClean's org-wide security policy. Every repository also ships its own SECURITY.md with repo-specific detail — this document covers what's shared across all of them.

Reporting a vulnerability

Email freclean7@gmail.com with details. Do not open a public GitHub issue for an unpatched vulnerability. FreClean does not yet have a bug bounty program — this may be added as the company grows.

Scope

This policy covers all freclean-* repositories: freclean-website, freclean-api, freclean-admin, freclean-dapp, freclean-payment, freclean-products, freclean-operations, freclean-entrepreneurship, freclean-docs, freclean-brand, freclean-data, freclean-contracts, and .github.

Shared principles across every repository

  1. No secret is ever committed. Every repo ships a .env.example with no real values; .env is git-ignored everywhere.
  2. No private key or seed phrase is ever requested, stored, transmitted, or logged by any FreClean system — see docs/05-web3-security.md.
  3. Authentication and authorization are enforced server-side, not just hidden in the UI — see freclean-api's RBAC implementation, mirrored in freclean-admin's navigation.
  4. Every mutating API action is audited — see freclean-api's auditLog middleware and freclean-admin's Audit Logs page.
  5. Known gaps are documented, not hidden — each repo's SECURITY.md includes a "known limitations" section, reviewed as part of this repo's checklist (docs/07-security-checklist.md).

Repository-specific security policies

Repo SECURITY.md
freclean-api Auth, RBAC, validation, rate limiting, audit logging
freclean-payment No private keys held; HMAC webhook verification; forward-only status transitions
freclean-dapp No private key/seed phrase ever requested; wallet connection model

Repos without a dedicated SECURITY.md yet (website, admin, products, operations, entrepreneurship, docs, brand) are covered by this org-wide policy until repo-specific detail is needed.

This repo's contents

Doc Covers
docs/01-secret-management.md How secrets are generated, stored, and rotated
docs/02-dependency-management.md Keeping dependencies current and scanned
docs/03-incident-response.md What happens when something goes wrong
docs/04-access-control.md RBAC consistency across freclean-api and freclean-admin
docs/05-web3-security.md Wallet, key, and treasury security across freclean-payment and freclean-dapp
docs/06-data-protection.md What data is collected, and how it's protected
docs/07-security-checklist.md Pre-production checklist, repo by repo
scripts/scan-for-secrets.sh A real script to scan a local checkout of all freclean-* repos for accidentally committed secrets

There aren't any published security advisories