Overview
Harden the software supply chain so vulnerable, malicious, unreviewed, or secret-containing changes cannot quietly enter ChainMove releases.
Problem
The project contains a large frontend/backend dependency tree, multiple lockfiles, blockchain libraries, payment integrations, and CI workflows. Dependency drift or compromised packages can expose user data and financial operations.
Scope
- Standardize the supported package manager and remove or document conflicting lockfiles.
- Add automated dependency vulnerability scanning with severity and exception policies.
- Generate a software bill of materials (SBOM) for release builds.
- Add secret scanning for commits, pull requests, build output, and common key formats.
- Pin GitHub Actions to immutable versions/SHAs and minimize workflow permissions.
- Add dependency-review checks for new transitive packages and license policy.
- Detect install scripts, typosquatting risks, abandoned packages, and unexpected binary artifacts.
- Add reproducibility checks for clean installs and production builds.
- Define a signed release/provenance strategy where supported.
- Add an auditable exception file with owner, reason, expiry, and remediation date.
Acceptance criteria
- CI blocks unapproved critical vulnerabilities and detected secrets.
- SBOM artifacts are produced without exposing environment values.
- Workflow tokens use least privilege.
- Dependency exceptions expire and cannot be permanent undocumented bypasses.
- Clean installs use one authoritative lockfile and produce consistent builds.
- Contributor forks cannot access trusted deployment secrets.
Tests/evidence required
Demonstrate detection of a seeded fake secret, a vulnerable test dependency, an unpinned workflow action, an expired exception, and lockfile drift.
Documentation
Add dependency update, vulnerability response, and emergency patch procedures.
Difficulty
Hard
Overview
Harden the software supply chain so vulnerable, malicious, unreviewed, or secret-containing changes cannot quietly enter ChainMove releases.
Problem
The project contains a large frontend/backend dependency tree, multiple lockfiles, blockchain libraries, payment integrations, and CI workflows. Dependency drift or compromised packages can expose user data and financial operations.
Scope
Acceptance criteria
Tests/evidence required
Demonstrate detection of a seeded fake secret, a vulnerable test dependency, an unpinned workflow action, an expired exception, and lockfile drift.
Documentation
Add dependency update, vulnerability response, and emergency patch procedures.
Difficulty
Hard