SouveraineOS/docs/substrate/audit/external-security-audit-prompt.md

External Security & Credential Audit — Souveraine public Branch

Audit the public branch of the Souveraine Rust project at /home/casey/Projects/souveraine/.git (ref: refs/heads/public).

Scope:

1. Hardcoded credentials — API keys, tokens, passwords, secrets in source code, configs, test fixtures, or comments.
2. LAN/private IPs — Any 10.x.x.x, 192.168.x.x, 172.16-31.x.x, or localhost references that might be stale or accidentally revealing.
3. Personal identifying info — Usernames, email addresses, real names, file paths with author names.
4. Commit history scrub — Search the full git history of the public branch (not just HEAD) for any of the above that might have been committed and later removed. Git history carries everything unless explicitly rebased/filtered.
5. Proprietary signals — Search for phrases like "copy from", "inspired by", "stolen from", "port of", "based on" or similar attribution language that could imply unlicensed use of third-party code. Also check for any copyright headers or license references in source files.
6. Dependency license compliance — Check Cargo.toml for any dependencies with restrictive licenses (GPL, AGPL) that might conflict with the project's open distribution intent.

Excluded from scope:

• Code quality, architecture, or design decisions
• Test coverage or functionality
• Documentation accuracy

Deliverable: A report with findings grouped by severity (CRITICAL, HIGH, MEDIUM, LOW), each with file path, line number, and recommendation for remediation. If clean, a simple "No issues found" is sufficient.

Note: The project uses git worktree — the public branch lives at a separate worktree path. Use git -C /home/casey/Projects/souveraine log public and git -C /home/casey/Projects/souveraine diff public~1..public for commit history analysis.