This is a study/POC repository under active development. Security fixes target the latest release on main and the develop integration branch. Older tags are not maintained.

Please do not open a public issue for a security problem. Report it privately to fkazeredo.dev@gmail.com with:

• a description of the issue and its impact;
• steps to reproduce (or a proof of concept);
• affected version/commit if known.

You will get an acknowledgement within a reasonable time. Coordinated, private disclosure is appreciated; we will credit reporters who wish to be credited. This being a study project, there is no bug-bounty — good-faith research is welcome.

No secret, key, certificate or .env file is ever committed. This is enforced in depth:

• .gitignore blocks .env* (except the tracked *.example templates), and all key/certificate material (*.pem, *.key, *.p12, *.jks, *.keystore, …) — see ADR-0023.
• Gitleaks runs as a blocking CI check on every push and pull request (.github/workflows/gitleaks.yml) and, optionally, as a local pre-commit hook (.pre-commit-config.yaml). Configuration: .gitleaks.toml.
• GitHub secret scanning + push protection should be enabled on the repository (Settings → Code security), so a pushed secret is blocked at the platform level.
• Runtime: the backend externalizes every secret via ${VAR:default} (never hardcoded); production secrets live only in .env.prod (git-ignored). The prod profile refuses to boot with any development default (ProdReadinessValidator, 9 fail-fast checks). Generate each production secret with the commands in docs/PRODUCTION-CHECKLIST.md.

The repository contains a small, enumerated set of development-only default credentials, on purpose (they let the app run locally and in CI with zero setup) and allowlisted in .gitleaks.toml:

• seed-user password dev12345;
• dev-metrics-secret, dev-quotation-site-secret, dev-payment-webhook-secret;
• the base64 dev platform key in AesGcmSecretCipher (logged with a loud warning when used);
• database acme / acme and Grafana admin / admin.

None of these are usable in production — ProdReadinessValidator blocks every one of them when the prod profile is active. Do not add new "dev default" secrets without allowlisting them here and documenting them.

main and develop are protected: changes land only through reviewed Pull Requests with passing checks. See CONTRIBUTING.md and ADR-0023.