From 0d3775bdbea449a3ad8c5954701a11bb9151ef0c Mon Sep 17 00:00:00 2001 From: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> Date: Fri, 24 Jul 2026 21:29:13 -0400 Subject: [PATCH] docs(security): clarify repository read access Co-authored-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> Signed-off-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> --- SECURITY.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 09ea73022..b7d163580 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -53,17 +53,23 @@ REST endpoints authenticate via the client signs a `kind:27235` event containing the request URL and method. The relay verifies the Schnorr signature and extracts the pubkey. -### Authorization — Channel Membership as the Gate +### Authorization — Channel and Community Membership -Channel membership is the **only** access control mechanism. There are no -separate ACL lists or capability taxonomies. If a principal (human or agent) -is a member of a channel, they can read and write to it. If they are not a -member, the relay rejects their requests — even if they are authenticated. +Channel membership controls access to channel-scoped events. If a principal +(human or agent) is a member of a channel, they can read and write to it. If +they are not a member, the relay rejects their requests — even if they are +authenticated. Private channels are invisible to non-members: they do not appear in channel listings, and subscription filters for private channel events return nothing unless the subscriber is a member. +Relay-hosted Git repositories are community-global resources rather than +channel-scoped events. Any identity admitted by the community's relay +membership policy can clone them. A `buzz-channel` binding, when present, +controls non-owner push authorization only; it does not restrict reads or make +the repository inherit a private channel's visibility. + ### Append-Only Audit Log All events are written to a tamper-evident audit log (`buzz-audit`). Each