FreClean Security

FreClean's org-wide security policy, plus a real, runnable secret-scanning script. This repo covers what's shared across every freclean-* repository; repo-specific detail lives in each repo's own SECURITY.md.

Status

Policy documented; several controls are marked pending in the checklist below and should be treated as launch blockers, not optional polish, before any repository handles real customer data or real payments.

Contents

Doc	Covers
SECURITY.md	Vulnerability reporting, scope, shared principles
docs/01-secret-management.md	Secret inventory, generation, rotation rules
docs/02-dependency-management.md	Current gap: no automated vulnerability scanning yet
docs/03-incident-response.md	Contain → assess → notify → remediate → document
docs/04-access-control.md	Why the UI hiding something is not a security boundary
docs/05-web3-security.md	The most important document here — private key handling, treasury, verification integrity
docs/06-data-protection.md	What's protected, and how, layer by layer
docs/07-security-checklist.md	Pre-production checklist, repo by repo
scripts/scan-for-secrets.sh	A working script — see below

Using the secret scanner

./scripts/scan-for-secrets.sh /path/to/all/freclean-repos

Checks a directory tree for private key headers, AWS-style access keys, suspiciously real secret/token assignments, raw Celo/Ethereum private keys, explicit mnemonic assignments, and any tracked .env file. It's a lightweight, dependency-free heuristic safety net — not a replacement for a proper tool like gitleaks or trufflehog in CI, which is still a tracked gap (see docs/02-dependency-management.md). Run it before any commit touching config, and before making any repository public. Expect occasional false positives (e.g. a public contract event signature that happens to be 32 bytes of hex) — that's the tool doing its job by asking for a human look, not a malfunction.

The one rule that matters most

No FreClean system ever requests, stores, transmits, or logs a private key or seed phrase. See docs/05-web3-security.md for how this is enforced by design, not just documented as policy.

License

Not provided.