mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-29 08:07:37 +09:00
Juan DenisandClaude Opus 4.8
f8ff93a4bd
Adds USDT (TRC-20 and ERC-20), BTC and SOL to the Support section of all four READMEs, with the network in its own column — USDT exists on several chains whose addresses look alike, and the network is what tells a donor which one to send on. QR codes come from scripts/generate-funding-qr.mjs rather than a web generator, since an online tool sits in a position to encode a different address than the one entered and the resulting image looks perfectly normal. The script holds the addresses as the single source of truth and checksum-validates each before encoding — base58check for Tron, EIP-55 casing for Ethereum, bech32 for Bitcoin, 32-byte base58 for Solana — refusing to emit anything if one fails. Every code was decoded back and diffed against its source string. `--check` re-verifies the committed PNGs so an address edit with a stale QR cannot pass unnoticed. These are self-custody wallets rather than exchange deposit addresses, which can be rotated out from under a published README and turn third-party donations into an AML review on the receiving account. Adds CODEOWNERS over the READMEs, the QR script, the funding images, FUNDING.yml, LICENSE and SECURITY.md. Swapping a donation address through an innocuous-looking docs PR is a known attack on open-source projects; this requests maintainer review on every path that carries one. It takes effect once "Require review from Code Owners" is on in branch protection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
1.4 KiB
Plaintext
31 lines
1.4 KiB
Plaintext
# Code owners for ServerKit.
|
|
#
|
|
# GitHub automatically requests a review from the listed owner on any PR that
|
|
# touches a matching path. Enable "Require review from Code Owners" in branch
|
|
# protection to make that review mandatory.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Funding and donation addresses — SECURITY SENSITIVE
|
|
# ---------------------------------------------------------------------------
|
|
# A swapped crypto address is a well-known open-source supply-chain attack:
|
|
# a drive-by PR edits one character in a donation address, it reads as a
|
|
# harmless docs tweak, and every subsequent donation goes to the attacker.
|
|
# These paths must never be merged without the maintainer reading the diff
|
|
# character by character against the wallet.
|
|
/.github/FUNDING.yml @jhd3197
|
|
/scripts/generate-funding-qr.mjs @jhd3197
|
|
/docs/images/funding/ @jhd3197
|
|
|
|
# The donation addresses live in the Support section of every README, so any
|
|
# change to these files needs the same scrutiny.
|
|
/README.md @jhd3197
|
|
/docs/README.es.md @jhd3197
|
|
/docs/README.pt.md @jhd3197
|
|
/docs/README.zh-CN.md @jhd3197
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Security policy and licensing
|
|
# ---------------------------------------------------------------------------
|
|
/SECURITY.md @jhd3197
|
|
/LICENSE @jhd3197
|