This is the most important security property of the project, so it is stated before anything else:
- No private keys. Members sign votes in their own environment. Solon only ever receives a signature.
- No funds. The treasury is watch-only: a treasury source is a label and an address to observe. There is no code path that can spend, and no amount field to drain.
- No rewritable history. Audit events are append-only; there is no update or delete path.
- A decision is evidence, not authority. OrangeCat re-verifies every vote signature against its own pinned keys before honoring a Solon decision. A compromised Solon cannot, by itself, move value on a sibling product.
Vulnerabilities that break any of these four claims are critical, whatever their CVSS score would otherwise be.
| Version | Supported |
|---|---|
| latest | ✅ |
If you discover a security vulnerability in this project, please report it responsibly:
- Do NOT create a public GitHub issue for security vulnerabilities
- Email the maintainer directly or use GitHub's private vulnerability reporting feature
- Include as much detail as possible:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Initial Assessment: Within 7 days
- Resolution Target: Within 30 days for critical issues
This project implements the following security measures:
- Dependency scanning via Dependabot
- Secret scanning enabled
- Code scanning (where applicable)
- Signed commits required from maintainers
- We follow coordinated disclosure
- Security patches will be released as soon as possible
- Credit will be given to reporters (unless anonymity is requested)