docs: add SECURITY.md

[tiero]

Adds the shared security disclosure policy, matching arkd, wallet and the SDKs. Reports go to security@arklabs.to.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ek8iDTwb1V7PVh1kKewSVg

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation
  • Added a security disclosure policy with private reporting instructions.
  • Added researcher acknowledgment details.
  • Published PGP key links, fingerprints, and import instructions for secure communication.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ac5da467-2b87-45b0-a8da-8662fac3db6d

📥 Commits

Reviewing files that changed from the base of the PR and between 948619a and 6090bc6.

📒 Files selected for processing (1)

• SECURITY.md

---

Walkthrough

Changes

Security Disclosure Policy

Layer / File(s)	Summary
Reporting and PGP instructions SECURITY.md	Adds private vulnerability reporting instructions, acknowledgment details, PGP key links and fingerprints, and a gpg --fetch-keys import command.

Estimated code review effort: 1 (Trivial) | ~2 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/security-md-arkd-migration-f3oqer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arkana-ai-bot]

Code Review — docs: add SECURITY.md

Scope: Documentation only. No protocol, API, signing, or VTXO-adjacent code touched. No cross-repo API breakage possible. Danger passed.

---

Findings

1. Short PGP fingerprints — best-practice issue SECURITY.md:11-13

All three listed fingerprints are 16-character (64-bit) short fingerprints:

0F6586CE8DA12FB1
6C7639DEA147673B
F918A46E23064E28

Full OpenPGP fingerprints are 40 hex characters (160-bit SHA-1). 64-bit short fingerprints are known to be collision-forgeable (the SKS Poisoning / Evil32 class of attacks). A researcher verifying with gpg --fingerprint after --fetch-keys will see 40 chars and can only confirm the last 16 of them match what's published here.

Mitigation: replace each with the full 40-character fingerprint. This is a pre-existing issue in arkd/SECURITY.md (same values appear there), so this PR didn't introduce it — but propagating the abbreviated form to another repo increases exposure surface.

2. Divergence from arkd/SECURITY.md — consistency issue SECURITY.md:3

arkd/SECURITY.md offers two reporting channels:

• Email: security@arklabs.to
• NIP-04 DM to a named npub

This file drops the NIP-04 channel and also changes the branding from "Ark" → "Ark Labs". If the omission of the Nostr channel is intentional for this repo, that's fine — but if it was accidental copy-paste divergence it should be reconciled. The PR body says it matches "arkd, wallet and the SDKs", but wallet/, ts-sdk/, go-sdk/, rust-sdk/, and dotnet-sdk/ do not yet have a SECURITY.md, so consistency across the estate is incomplete regardless.

---

Summary

No protocol-critical issues; no code is changed. The two items above are best-practice / consistency notes, both inheritable from the existing arkd baseline rather than newly introduced here. Recommended follow-up: (a) publish full 40-char fingerprints across all SECURITY.md files fleet-wide, (b) decide on a canonical channel list and branding string and apply uniformly.