We take the security of NOFX seriously. This document outlines our security policy and procedures for reporting vulnerabilities.

We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please follow these steps:

Send an email to the security team at:

• Email: tinklefund@gmail.com (or contact maintainers directly via Twitter DM)
• Twitter: @nofx_official or @Web3Tinkle

Please include the following details in your report:

• Description: A clear description of the vulnerability
• Impact: The potential impact of the vulnerability
• Steps to Reproduce: Detailed steps to reproduce the issue
• Proof of Concept: If applicable, include PoC code or screenshots
• Suggested Fix: If you have ideas on how to fix it
• Your Contact Information: For follow-up questions

• Initial Response: Within 48 hours of receiving your report
• Status Update: Weekly updates on the progress
• Fix Timeline: Critical issues within 7 days, others within 30 days
• Public Disclosure: After the fix is deployed (coordinated disclosure)

After you submit a report:

1. ✅ We will acknowledge receipt of your report
2. 🔍 We will investigate and validate the issue
3. 📋 We will develop and test a fix
4. 🚀 We will deploy the fix to production
5. 📢 We will coordinate public disclosure with you
6. 🏆 We will credit you in the security advisory (if desired)

If you're using NOFX, please follow these security best practices:

• ❌ Never commit API keys, private keys, or secrets to version control
• ✅ Use environment variables for all sensitive configuration
• ✅ Rotate keys regularly (at least every 90 days)
• ✅ Use separate keys for different environments (dev/staging/prod)
• ✅ Implement IP whitelisting for exchange API keys
• ✅ Enable 2FA on all exchange accounts

• ❌ Never share your private keys with anyone
• ✅ Use dedicated wallets for trading (not your main wallet)
• ✅ Use agent wallets when available (Hyperliquid)
• ✅ Limit wallet funds to amounts you can afford to lose
• ✅ Back up keys securely using encrypted storage

• ✅ Enable API key restrictions (IP whitelist, permissions)
• ✅ Use read-only keys for monitoring when possible
• ✅ Set withdrawal restrictions on exchange accounts
• ✅ Monitor API usage for unusual activity
• ✅ Revoke compromised keys immediately

• ✅ Keep dependencies updated (run npm audit and go mod tidy)
• ✅ Use HTTPS for all external communications
• ✅ Implement rate limiting on API endpoints
• ✅ Enable authentication on production deployments
• ✅ Review logs regularly for suspicious activity
• ✅ Use Docker for isolated environments

• ✅ Encrypt sensitive data at rest (API keys, private keys)
• ✅ Restrict database access (not exposed to internet)
• ✅ Back up regularly with encrypted backups
• ✅ Use strong passwords for database credentials

• ❌ Never use default passwords or weak credentials
• ✅ Change default ports if exposed to internet
• ✅ Disable unnecessary features in production
• ✅ Use firewall rules to restrict access
• ✅ Implement RBAC for multi-user setups

The following are not considered security vulnerabilities:

• ❌ Trading losses due to AI decisions
• ❌ Exchange API rate limiting
• ❌ Network latency issues
• ❌ Market volatility impacts
• ❌ Social engineering attacks
• ❌ DDoS attacks on public infrastructure
• ❌ Issues in third-party dependencies (report to upstream)
• ❌ Already known and documented limitations

We appreciate the security research community's efforts. Contributors who responsibly disclose vulnerabilities will be:

• ✅ Credited in security advisories (with permission)
• ✅ Listed in our Hall of Fame (coming soon)
• ✅ Eligible for bug bounties (when program launches)

• Getting Started Guide
• Architecture Documentation
• Docker Deployment Guide
• Troubleshooting Guide

• Code Scanning: GitHub Advanced Security (enabled)
• Dependency Scanning: Dependabot (enabled)
• Secret Scanning: GitHub Secret Scanning (enabled)
• Container Scanning: Docker Scout (recommended)

• OWASP Top 10
• CWE Top 25
• NIST Cybersecurity Framework

NOFX uses the following security measures:

• AES-256 encryption for sensitive data at rest (planned v3.1)
• TLS 1.3 for all network communications
• JWT tokens for API authentication
• bcrypt for password hashing (where applicable)
• Environment isolation via Docker containers

We follow a coordinated disclosure approach:

1. 📧 Report received and acknowledged
2. 🔍 Investigation and validation (1-7 days)
3. 🛠️ Fix development and testing (7-30 days)
4. 🚀 Fix deployment to production
5. 📢 Public advisory published (after fix)
6. 🏆 Credit to researcher (if desired)

Please allow us time to fix critical issues before public disclosure.

For security concerns, reach out via:

• Email: Contact maintainers (see GitHub profile)
• Twitter: @nofx_official (DM open)
• Telegram: NOFX Developer Community
• GitHub: Private security advisory (preferred for verified issues)

Safe Harbor: We consider security research conducted under this policy to be:

• ✅ Authorized in accordance with applicable law
• ✅ Lawful and in good faith
• ✅ Exempt from DMCA and CFAA claims
• ✅ Protected from legal action by the project

Conditions:

• Make a good faith effort to avoid privacy violations
• Do not access or modify other users' data
• Do not disrupt our services or infrastructure
• Do not publicly disclose issues before we've had time to address them

This security policy may be updated from time to time. We will notify users of significant changes via:

• GitHub release notes
• Security advisories
• Community channels (Telegram, Twitter)

Last Updated: January 2025 Version: 1.0.0

Thank you for helping keep NOFX and its users safe! 🙏

• Contributing Guidelines
• Code of Conduct
• License
• Changelog