docs: replace inherited Frontier branding and disclosure policy - #135
Open
0xrlawrence wants to merge 1 commit into
Open
docs: replace inherited Frontier branding and disclosure policy#1350xrlawrence wants to merge 1 commit into
0xrlawrence wants to merge 1 commit into
Conversation
The docs site and the security policy were carried over from Frontier and still describe that project rather than this one. - SECURITY.md routed vulnerability reports to security@bitarray.dev and to "the Frontier repo", so a report about the shielded pool would have reached Frontier's maintainers rather than Orbinum's. Rewritten around security@orbinum.net, the address CONTRIBUTING.md already names, with a scope section covering the node, orbinum/circuits, and the SDKs, and a note routing genuine upstream Frontier issues back to Frontier. - docs/.vitepress/config.mts set title "Frontier", base '/frontier', a GitHub link to polkadot-evm/frontier, an API link to Frontier's rustdocs, and a "Copyright Frontier developers" footer. - docs/index.md and docs/overview.md were Frontier's landing page and its explanation of Frontier's three EVM integration models, neither of which applies here. Replaced with an Orbinum overview drawn from the repository README and the pallet documentation: the public/private domains, the commitment and nullifier construction, what the transfer proof establishes, gasless submission, note recovery, and the crate layout. - CONTRIBUTING.md gave a fixed "estimated opening date" for external contributions that has now passed. Replaced with a pointer to Discussions so the section does not silently go stale again, and linked SECURITY.md from the vulnerability-reporting line. Documentation only. No code or configuration outside docs/ is touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The docs site and the security policy were carried over from Frontier and still describe that project rather than this one. Everything here is documentation.
What this changes
SECURITY.mdwas Frontier's verbatim. It routed vulnerability reports tosecurity@bitarray.devand told low-severity reporters to "open an issue in the Frontier repo directly", so a report about the shielded pool would have gone to Frontier's maintainers rather than yours. Rewritten aroundsecurity@orbinum.net, whichCONTRIBUTING.mdalready names, with a scope section covering the node,orbinum/circuits, and the SDKs, plus a line routing genuine upstream Frontier issues back upstream. I also stated plainly that there is no bug bounty, since that is a question a reporter will otherwise ask.docs/.vitepress/config.mtssettitle: "Frontier",base: /frontier, a GitHub social link topolkadot-evm/frontier, an API link to Frontier'spallet_evmrustdocs, and aCopyright © 2018-present, Frontier developersfooter.docs/index.mdanddocs/overview.mdwere Frontier's landing page and its explanation of Frontier's three EVM integration models (EVM-execution-only, post-block generation, pre-block feeding). None of that describes this repository. Replaced with an Orbinum overview built from the README, the pallet docs, and the Circom circuits: the public/private domains, the commitment and nullifier construction, what the transfer proof establishes, gasless submission, note recovery, and the crate layout.CONTRIBUTING.mdgave a fixed "estimated opening date" for external contributions that has now passed. Replaced with a pointer to Discussions so the section does not silently go stale again, and linkedSECURITY.mdfrom the vulnerability-reporting line.Two things I could not decide for you
base: /frontierhad to become something. I used/nodeon the assumption of GitHub Pages atorbinum.github.io/node, but if this site is deployed elsewhere the value should match that, and the API link needs the same treatment. Both are one-liners to adjust.docs.orbinum.networkexists, this VitePress site may be vestigial. If so, deletingdocs/is probably a better change than this one, and I am happy to redo it that way.Cargo.tomlstill listshomepage = "https://orbinum.net"andcontact@orbinum.netwhile the live site isorbinum.network. I left those alone rather than guess which is canonical.Verification
Documentation only, no code or configuration outside
docs/touched. I was not able to build the workspace, so I have not run the VitePress build. The config change is a value swap on five existing keys, but thebasepath is worth a second look for the reason above.Separately, I have emailed
security@orbinum.netabout a small number of higher-severity findings from the same review pass. Those are deliberately not in this PR, in any other PR, or in a public issue. Happy to hold them for as long as you need.