SkateSpots/SECURITY.md

# Security Policy

SkateSpots is a **client-side, decentralized Nostr web application**. There is no
central backend that holds user data — the app runs entirely in the browser and
talks directly to Nostr relays, Blossom media servers, Lightning wallets, and a
few public read-only APIs. This document is written for security researchers and
auditors reviewing the codebase.

- **Live app:** https://skate-spots.org
- **Source (Nostr git):** `nostr://npub1yrnuj56rnen08zp2h9h7p74ghgjx6ma39spmpj6w9hzxywutevsst7k5cx/git.shakespeare.diy/SkateSpots`
- **Stack:** React 18 + Vite + TypeScript, TailwindCSS, shadcn/ui, Nostrify, TanStack Query, Leaflet.

---

## Reporting a Vulnerability

Please report privately first — **do not** open a public issue or publish a PoC
before we've had a chance to respond.

- **Nostr DM (preferred):** `npub1yrnuj56rnen08zp2h9h7p74ghgjx6ma39spmpj6w9hzxywutevsst7k5cx`
- **NIP-05:** `skatespots@skate-spots.org` (seeded platform handle)

Please include:

1. A clear description of the issue and its impact.
2. Reproduction steps (a minimal PoC event/payload is ideal).
3. The affected file(s) / route(s) and, if known, a suggested fix.

We aim to acknowledge reports within a few days. Because this is a
community-run, non-commercial project there is **no paid bug bounty**, but
credit is gladly given to reporters who want it.

### In scope

- The web app served from `https://skate-spots.org` and this repository's source.
- XSS / script injection, CSP bypasses, unsafe handling of untrusted event data,
  URL/CSS injection, clickjacking, and logic flaws that leak or misuse user
  secrets (Nostr keys, wallet credentials).

### Out of scope

- **Plaintext storage of `nsec` / wallet credentials in `localStorage`.** See
  [Threat model](#threat-model) — this is inherent to client-side Nostr signing
  and Lightning payments, not a defect unique to this app. Reports about *the
  existence* of these values in storage will be closed as "by design"; reports
  about a way to *reach* them (e.g. an XSS) are very much in scope.
- Vulnerabilities in third-party relays, Blossom servers, Cashu mints, wallets,
  browser extensions, or signer apps the user chooses to connect.
- Denial of service against public relays/APIs, spam, or rate-limit abuse.
- Social engineering, phishing of end users, or physical/device compromise.
- The native Capacitor (iOS/Android) wrappers' OS-level sandboxing.

---

## Threat model

**The most dangerous class of bug in this app is XSS**, because a Nostr web
client necessarily handles secrets in the browser:

- **Nostr private key (`nsec`).** For accounts created in-app or logged in by
  pasting an nsec, Nostrify stores the key inside the login object in
  `localStorage` (`nostr:login`). Logging in with a **browser extension (NIP-07)**
  or a **remote signer / bunker (NIP-46)** keeps the key *outside* the page and
  is the recommended high-security path.
- **Lightning wallet credentials.** NWC connection strings
  (`nostr+walletconnect://…`) are stored in `localStorage` under
  `nwc-connections`. The embedded secret authorizes `pay_invoice`.
- **Cashu ecash (native build only).** The mobile (Capacitor) build enables a
  built-in Cashu wallet that the web build disables (`isNativePlatform()` gate
  in `src/hooks/wallet/useCashu.ts`). Its bearer **proofs** live in IndexedDB
  (database `cashu-wallet`) and its **seed mnemonic** in `localStorage`
  (`cashu-mnemonic`). Ecash proofs are bearer instruments — whoever reads them
  can spend them. An injected script on the app origin can drain them directly,
  in addition to the nsec/NWC theft above.

**This is not "web only."** The mobile app is the same bundle wrapped in
Capacitor and is exposed to the identical map/relay injection surface.

A **Nostr key cannot be rotated in place** — an `nsec` compromise is permanent
and follows the user across every Nostr client they use. Therefore any code path
that can execute attacker-controlled script on our origin is treated as
**critical**. Defense is layered:

1. **Never inject untrusted data as markup.** No `dangerouslySetInnerHTML`,
   `innerHTML`, `insertAdjacentHTML`, or `document.write` with event/API/URL
   data. React's JSX auto-escaping is the default; where we build DOM manually
   (e.g. Leaflet popups) we use `document.createElement` + `textContent`.
2. **Content Security Policy** as defense-in-depth (see below).
3. **URL sanitization** for any event/API URL before it reaches an
   `href` / `src` / CSS `url()`.
4. **Budget guidance** to cap the blast radius of the one credential the app
   must actively hold (NWC).

### Trust boundaries

Everything below is **untrusted** and must be treated as attacker-controlled:

- All Nostr event content and tags (any pubkey can publish any event to a relay
  we read from — spots, tours, crews, events, profiles, notes, reactions, zaps).
- Responses from third-party APIs (e.g. BTC Map places, weather, geocoding).
- URL parameters and NIP-19 identifiers in the address bar.
- Relay responses in general — relays are dumb pipes; a matching event is not a
  trusted event.

---

## Defenses in place

### Content Security Policy

The CSP applies to **both the web build and the native (Capacitor) build**.
This matters: the mobile app ships the **same `dist/` bundle** (`webDir: 'dist'`
in `capacitor.config.ts`) and renders the same untrusted relay content, so it is
exposed to the same injection vectors. The OS app sandbox isolates the app from
*other apps* — it does **not** stop a same-origin injected script from reading
this app's own `localStorage` (nsec, NWC string, Cashu seed) or IndexedDB
(Cashu ecash proofs). A CSP is therefore required on mobile as much as on web.

Because Capacitor serves the bundle from a local scheme
(`https://localhost` on Android, `capacitor://localhost` on iOS), HTTP response
headers never reach the mobile WebView. The CSP is therefore defined in **three
places that must be kept in sync**:

- **`index.html`** — a `<meta http-equiv="Content-Security-Policy">` tag. This
  is the one that reaches the **native build** (and also applies on web). It
  allowlists Capacitor's local origins so asset loading/live-reload still work.
- **`public/_headers`** — HTTP header for nsite / static-host / Netlify
  `_headers`-style web hosting.
- **`netlify.toml`** — HTTP header (`[[headers]]`) for Netlify.

The header versions additionally carry `frame-ancestors 'none'` and
`upgrade-insecure-requests`, which are ignored when delivered via `<meta>`
(so they live only in the header copies). The meta copy allowlists
`https://localhost capacitor://localhost ionic://localhost` on
`script-src`/`style-src`/`img-src`/`connect-src` for Capacitor compatibility.

Effective policy (header form):

```
default-src 'none';
script-src 'self' 'wasm-unsafe-eval';   # no 'unsafe-inline', no 'unsafe-eval'
style-src 'self' 'unsafe-inline' https://unpkg.com;
img-src 'self' data: blob: https:;
font-src 'self' https://fonts.gstatic.com data:;
connect-src 'self' https: wss:;
media-src 'self' blob: https:;
frame-src 'self' https:;
worker-src 'self' blob:;
manifest-src 'self';
object-src 'none';
base-uri 'none';
form-action 'self';
frame-ancestors 'none';           # header-only (ignored in <meta>)
upgrade-insecure-requests         # header-only (ignored in <meta>)
```

Notes and known trade-offs:

- **`script-src 'self'`** — no inline scripts. The boot crash-guard was moved
  out of `index.html` into `public/boot-guard.js` specifically so we could drop
  `'unsafe-inline'`. `'wasm-unsafe-eval'` is included because the Bitcoin/Cashu
  crypto libraries use WebAssembly; it does **not** permit `eval`/`new Function`.
- **`style-src 'unsafe-inline'`** — required by Tailwind/shadcn and Leaflet
  inline styles. This means **CSS injection is not blocked by CSP**; the app
  must sanitize any untrusted value that reaches a style/`url()` (see below).
- **`connect-src`/`img-src`/`media-src` allow broad `https:`/`wss:`** — by
  design. Users add their own relays (arbitrary `wss://`), Blossom media hosts,
  and Cashu mints; images live on arbitrary hosts. A fixed allowlist would break
  core decentralized functionality. `object-src`/`base-uri`/`frame-ancestors`
  are locked down to `'none'` where it costs nothing.

Additional headers: `X-Content-Type-Options: nosniff`,
`X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`,
`Permissions-Policy: geolocation=(self), camera=(self), microphone=()`.

### Untrusted-data rendering

- **React/JSX** auto-escapes all interpolated strings — the default rendering
  path. Do not bypass it.
- **Leaflet map popups & marker icons** (`src/components/SpotMap.tsx`) are the
  one place we build DOM by hand. Popups set `innerHTML` from a template in which
  **every dynamic value is passed through `escapeHtml`** (re-verified 2026-10-12);
  marker icons and the weather card use `textContent`. Image/website fields are
  validated before use.
- Rich Nostr note content is rendered through the shared `NoteContent`
  component/tokenizer rather than raw HTML.

### URL & CSS sanitization

- `src/lib/sanitizeUrl.ts` — `sanitizeUrl()` allows only `http(s)` URLs and
  returns a parsed href (quotes percent-encoded, safe inside attributes and
  `url()`); it returns `null` for `javascript:`, `data:`, and malformed input.
  Companion helpers: `sanitizeTel()`, `sanitizeEmail()`, `urlDomain()`.
- Any event/API-sourced URL (profile `picture`/`banner`/`website`, crew image,
  BTC Map website, social links, etc.) is passed through `sanitizeUrl()` before
  it touches an `href`/`src`/CSS value.

### Author-scoped queries for trust-sensitive data

Addressable (kinds 30000–39999) and replaceable events are queried with the
author's pubkey as part of the trust key — a `d` tag alone is **not** a trust
boundary. Detail routes carry the author pubkey in the URL
(e.g. `/crew/:pubkey/:identifier`, `/spot/:pubkey/:identifier`) so handlers can
build author-scoped filters. Public UGC feeds (kind 1, reactions, zaps) are
intentionally *not* author-filtered.

### Lightning / NWC exposure

- NWC connection strings are spend credentials the app must hold to send zaps.
  The "Connect NWC Wallet" dialog (`src/components/WalletModal.tsx`) prominently
  instructs users to set a small **daily budget** in their wallet, scope the
  connection to **`pay_invoice` only**, and revoke it any time. This caps the
  worst-case loss from a compromised connection.
- Prefer wallets/flows that let you set a spending budget.

### Admin moderation / takedowns

Two hardcoded admin pubkeys (`src/lib/admins.ts`, `ADMIN_PUBKEYS`) can take
down any listing — spots, crews, tours, events, shops, Lab profiles (coaches,
filmers, editors, photographers, builders, artists, graffiti, tattoo, trainers,
musicians), and gear/marketplace listings. A takedown publishes both a NIP-09
kind:5 deletion request **and** a NIP-32 kind:1985 `hidden` moderation label
authored by the admin. The client-side layer (`useAdminModeration`, wired into
every list/detail hook via React Query `select`) then hides that content across
the app, so takedowns are reliable even when a relay won't honor a cross-author
NIP-09 request. **Trust boundary:** only labels whose
`pubkey` is in the hardcoded admin list are honored — this is re-verified
client-side in `useAdminModeration` and is never derived from a `d` tag or any
attacker-controllable value. Auditors should confirm the admin list is the only
source of moderation authority.

### Tooling

- A custom ESLint rule (`eslint-rules/no-inline-script.js`) forbids inline
  `<script>` in HTML, keeping `script-src 'self'` enforceable.

---

## Known residual risks (accepted)

These are documented limitations of a client-side Nostr/Lightning app, not
oversights:

- **`nsec` and NWC strings live in `localStorage`, and Cashu ecash proofs live
  in IndexedDB (native build), in plaintext.** Any script running on the origin
  can read them — on **both web and mobile**. Encrypting them client-side offers
  no real protection (the decryption key would live in the same JS context). The
  meaningful mitigation is preventing script injection (CSP shipped in the bundle
  so it also covers mobile + no-`innerHTML` discipline) and offering
  extension/bunker login for users who want keys off the page. (The Cashu wallet
  *seed* is a partial exception — see "Known limitations — Cashu wallet" below.)
- **Broad `connect-src`/`img-src`.** Necessary for user-chosen relays, mints,
  and media hosts. This permits data exfiltration *if* script execution is ever
  achieved — which is why preventing XSS is the top priority.
- **`style-src 'unsafe-inline'`.** Required by the CSS framework; CSS-injection
  defense is handled by input sanitization rather than CSP.

### Known limitations — Cashu wallet

The built-in Cashu ecash wallet is **native-only** (browsers block most mints via
CORS). Its BIP-39 mnemonic is the master key to all ecash funds, so it gets
stronger handling than other secrets:

- **Seed storage location (per platform).**
  - **Native (Android / iOS):** the mnemonic is stored in the OS-backed secure
    store — Android **KeyStore** / iOS **Keychain** — via
    `capacitor-secure-storage-plugin` (`src/lib/secureStorage.ts`), **not** in
    plaintext `localStorage`. Existing users on an older build are migrated
    transparently on first read (the legacy plaintext `cashu-mnemonic` copy is
    moved into secure storage and the plaintext removed).
  - **Web:** falls back to `localStorage` (same accepted-risk posture as `nsec`
    above). The wallet is effectively native-only in practice, so web plaintext
    exposure is a minor surface.
  - Ecash **proofs** (the spendable tokens) still live in IndexedDB
    (`cashu-wallet`) in plaintext on device — a stolen unlocked device can spend
    them, exactly like cash. Loss of the seed without a backup = permanent loss.

- **Backup behavior (Android / native).** A freshly auto-generated seed sets a
  `needsBackup` flag that forces a **mandatory, non-dismissable backup step**
  (`RecoveryPhraseDialog` in `requireConfirm` mode): the user must reveal the 12
  words and explicitly confirm ("I've written it down") before the wallet is
  usable. This prevents a silently generated seed from being left un-backed-up —
  clearing app storage without a backup means the funds are unrecoverable. The
  phrase can be re-viewed any time from the wallet ("View Recovery Phrase").

- **Planned / status.** Secure-storage migration is **shipped** (native seed now
  in Keychain/KeyStore). Remaining accepted risk: proofs-at-rest in IndexedDB and
  the web-only `localStorage` fallback. Encrypting proofs on-device is tracked as
  a future hardening item but offers limited value while the key must live in the
  same JS context (same reasoning as `nsec` above).

  Relevant files: `src/hooks/wallet/useCashu.ts`, `src/lib/secureStorage.ts`,
  `src/components/wallet/RecoveryPhraseDialog.tsx`.

---

---

## Audit log — 2026-10-12 (code review + dependency scan)

A targeted review of the client (`src/`), the standalone servers (`cvm-server`,
`push-service`, `ai-proxy`, `netlify/functions`) and the dependency tree.

**No exploitable issue was found in app code.**

- **Injection / XSS:** no `eval` / `new Function`; `dangerouslySetInnerHTML`
  appears only in shadcn's `chart.tsx` (static, developer-defined chart CSS). The
  hand-built Leaflet popup HTML interpolates values but every dynamic value is
  `escapeHtml`'d (verified). `document.write` (recovery-phrase QR and rider-card
  print windows) interpolates only canvas data-URLs and i18n strings. No
  `__proto__` / prototype pollution. No secrets in web storage beyond the
  documented `nsec`/NWC/Cashu.
- **Reverse tabnabbing:** every `target="_blank"` also carries
  `rel="noopener noreferrer"`.
- **SSRF:** the only `fetch` to a derived host is
  `https://<domain>/.well-known/lnurlp/…` where the domain comes from a
  **hardcoded platform Lightning address** (not user input). Servers do not fetch
  user-supplied URLs. The push service additionally validates subscription
  endpoints (`isSafePushEndpoint`: https-only; blocks localhost + private /
  link-local / CGNAT ranges).
- **Auth:** NIP-98 (kind 27235) signature + timestamp checks gate push
  subscribe/unregister and the AI proxy; zap receipts and owner-grant labels are
  signature-verified (`verifyEvent`) on both client and servers; the CVM server
  signature-verifies event content before serving it to agents.
- **CORS:** the AI proxy and push service enforce origin allowlists; the NIP-05
  well-known function is intentionally `Access-Control-Allow-Origin: *` (public).
- **Randomness:** `Math.random` is used only for UI ids, probe/subscription ids,
  PoW nonces and privacy timestamp jitter — never for secrets or tokens.

**Dependencies (`npm audit`).** `npm audit fix` updated `@remix-run/router` (open
redirect), `@modelcontextprotocol/sdk`, `@humanfs/node`, `valibot` and
`brace-expansion`, but was **reverted** because it re-resolved the lockfile and
broke the build (a nested `@nostrify/nostrify` duplicate introduced a type
conflict). Re-assessment: none of the remaining advisories is reachable from the
shipped app —

- `xlsx` (high, prototype pollution + ReDoS, no fix): used only to **generate** the
  deck-cost workbook (`XLSX.writeFile`); imported files are never **parsed**, so
  the parsing flaws are unreachable. Accepted.
- `@remix-run/router` open redirect: unreachable — the app uses **HashRouter**, so
  navigation stays inside the `#` fragment and never crosses to an external URL.
- `@modelcontextprotocol/sdk` OAuth flaw: affects MCP **clients** connecting to
  untrusted servers; `cvm-server` is an MCP **server**, not a client. Not
  applicable.
- `braces`, `@vitest/mocker`, `@capacitor/cli`'s `uuid`, `tailwindcss`: build/test
  tooling only — no runtime reach into the served app. Accepted.

A broken build is a larger risk than an unreachable CVE, so the broken fix was
reverted rather than forced through.

---

## For auditors: where to look first

| Area | Files |
|------|-------|
| Manual DOM / map popups (highest XSS risk) | `src/components/SpotMap.tsx` |
| URL/CSS sanitization helpers | `src/lib/sanitizeUrl.ts` |
| Event parsers (untrusted → typed) | `src/lib/types.ts` |
| Rich text rendering | `src/components/NoteContent.tsx` |
| Login / key handling | `src/components/auth/`, Nostrify login (`nostr:login`) |
| Lightning / NWC | `src/hooks/useNWC.ts`, `src/components/WalletModal.tsx` |
| Cashu ecash (native only): proofs in IndexedDB `cashu-wallet`; seed in OS Keychain/KeyStore (secure storage), localStorage fallback on web | `src/hooks/wallet/useCashu.ts`, `src/lib/secureStorage.ts`, `src/lib/platform.ts` |
| Admin authority / moderation / takedowns | `src/lib/admins.ts`, `src/hooks/useAdminModeration.ts`, `src/hooks/useDeleteEntity.ts`, `src/components/DeleteEntityDialog.tsx`, `src/components/GearSwapItemCard.tsx` |
| CSP & security headers | `index.html` (`<meta>` — covers mobile), `public/_headers`, `netlify.toml`, `public/boot-guard.js` |
| Native wrapper (same bundle) | `capacitor.config.ts` (`webDir: 'dist'`) |
| NIP-19 routing | `src/pages/NIP19Page.tsx`, `src/AppRouter.tsx` |
| Custom lint rules | `eslint-rules/` |

Thanks for helping keep the skate community safe. 🛹