Open a private GitHub Security Advisory or contact the owner via Telegram @miner_pulse.
| Item | Status |
|---|---|
Private signing key .tauri/minerpulse.key |
✅ Not in git (gitignored); only in GitHub Actions Secrets |
Public updater pubkey in tauri.conf.json |
✅ OK — must be public for signature verification |
releases/update.json signature |
✅ OK — minisign signature of installer, not a secret |
.env / credentials files |
✅ Not tracked |
Documents/ (vendor API PDFs) |
✅ Untracked; added to .gitignore |
OldProject/ (local prototypes) |
✅ Not tracked; added to .gitignore |
| Git history scan for private keys / PATs | ✅ No matches found |
| Donation wallet in README / About | ℹ️ Intentionally public |
| Developer name in About / LICENSE | ℹ️ Intentionally public |
GitHub Actions secrets (expected): TAURI_SIGNING_PRIVATE_KEY, TAURI_SIGNING_PRIVATE_KEY_PASSWORD — values are not in the repository.
.tauri/*.key(Tauri updater private signing key).env, API keys, JWT signing private keys, Stripe/Paddle keys- TLS certificates /
.pem/.p12with private material - Database passwords, production URLs with embedded tokens
- User miner passwords (only stored locally in app
localStorage, never sent to GitHub)
Before push, run:
node scripts/check-secrets.mjs --allCI runs the same check on every push (.github/workflows/secrets.yml).
- Updates are distributed via signed installers (minisign / Tauri updater).
- Manifest: releases/update.json
- Public key:
minerpulse-desktop/src-tauri/tauri.conf.json→plugins.updater.pubkey - Private key: local
.tauri/minerpulse.key+ GitHub Actions secretTAURI_SIGNING_PRIVATE_KEY
Never disable updater signature verification in the client.
- Release builds start on Free tier; dev tier cycling is disabled in production.
set_tieris a debug-only helper — not a license system.- Future: entitlements and API keys must be validated on minerpulse-api (private), not only in the desktop app.
Planned split (see REPOSITORY.md):
| Component | Visibility |
|---|---|
minerpulse-desktop + UI shell |
Public (this repo) |
minerpulse-core drivers (current) |
Public for now |
| License JWT verification, API keys, billing | Private repo / server only |
| Proprietary encryption / entitlement algorithms | Private crate or server-side |
Do not add production API keys or encryption secrets to this public tree. Use .env (gitignored) locally and GitHub Secrets in CI. Template: .env.example.
- NSIS
installMode: perMachine— installs for all users under Program Files; requires administrator at install time (UAC). - Runtime: no admin required for LAN miner TCP (local network).
- Updater: downloads and installs signed package in-app (passive mode on Windows).
- Miner IP/port and optional WhatsMiner LuCI credentials are stored in browser localStorage on the user's machine (plain text). They are not uploaded to GitHub or Miner Pulse servers unless you add such a feature explicitly.
fetch_options.rs includes factory defaults (root/root, admin/admin) used to try LuCI on miners. These are device factory defaults, not your personal passwords.