Help wanted: Security audits of Passcrow

[BjarniRunar]

It would be nice to have the code looked over by someone who knows what they are doing and is not me.

[bmtriet]

Hi! If this audit request is still relevant, I can do a free lightweight public-repo pass on Passcrow.

I ran a very small first sweep locally: no obvious committed token/key patterns jumped out from tracked files. The first low-noise items I would start with are repo-level review plumbing: add a SECURITY.md with reporting/scope guidance and add a minimal CI workflow so future crypto/recovery-flow changes get at least a repeatable smoke check.

Scope-wise, I would keep this to public code and docs only: protocol/threat-model notes, secret-handling paths, recovery-flow edge cases, dependency/CI hygiene, and docs that might confuse operators into unsafe config. No private credentials or account access needed, and this would be a lightweight review, not a certified pentest. No worries if this is stale or not useful.