EXTENDED DOCUMENTATION
Security Audit Notes
This document tracks the current security hardening baseline for NeoOS Services and the checks that must pass before release.
Current Automated Coverage
- Root dependency audit is guarded by so known CityOfZion baseline findings stay explicit instead of silently expanding.
- Repository verification runs script tests, control-plane tests, worker checks/tests, relayer checks/tests, web consistency checks, web unit tests, and web production build.
- Web security headers are defined in and covered by .
- Documentation navigation is covered by , including static docs routes and extended Markdown-backed pages.
- Contract artifact generation is validated by when and the pinned compiler are available.
Manual Release Checklist
Before a production release, verify:
- passes in a clean checkout.
- The contract CI job installs the pinned Neo C# compiler and runs successfully.
- No secrets, private keys, service-role keys, tokens, or connection strings are committed or printed in logs.
- Production environment variables are scoped by network and deployment target.
- Callback, relayer, paymaster, and txproxy allowlists are reviewed against the intended deployment contracts.
- Any live smoke tests use dedicated testnet funds/accounts and do not reuse production signer material.
Public API Route Policy
The following
routes are intentionally public and are hardened against enumeration and DoS abuse. They are rate-limited by (Upstash-backed when configured, in-memory otherwise) and enforce Zod input validation via .| Route | Authentication | Rate limit | Validation |
|---|---|---|---|
| Runtime/admin token required | 60 req/min | No unexpected query params | |
| Runtime/admin token required | 60 req/min | No unexpected query params | |
| Public (no token) | 60 req/min | No unexpected query params | |
| Runtime/admin token required | 30 req/min | and optional |
Authentication uses the shared runtime-token check in
(, , or presented as a Bearer token or header). Unauthenticated requests to protected routes receive ; malformed inputs receive ; rate-limited requests receive . Responses include , , and headers.Known Environment Caveat
Local developer machines that do not have
and installed will skip the contract compilation regression test. CI must still enforce contract compilation using the pinned compiler before release.TEE Child Process Hardening
The Nitro worker spawns untrusted scripts and WASM modules in child processes. In production the following settings must be enforced:
- The Node.js permission model is ON by default for script/WASM child processes. It can only be disabled by the explicit dev override , and that override is IGNORED when (fail closed). The retired toggle no longer has any effect.
- must contain specific hostnames or IP addresses. Wildcards (), , , and CIDR blocks are rejected at startup.
- and should be limited to the paths required by the workload.
- The Node.js permission model is applied automatically via in and .
Cron Diagnostic Policy
The
endpoint returns a generic response to unauthenticated callers. Diagnostic details (header presence, request metadata, and configuration checks) are logged server-side only and never included in the response body.CURRENT DESIGNUPDATED FOR DUAL-CVM ARCHITECTURE