# Security

This repo publishes data and a static page. It holds no keys and moves no funds.

- Credentials are read from the environment at run time and never committed: `GOOGLE_APPLICATION_CREDENTIALS`, `INTENTS_JWT`, `INTENTS_JWT_FILE`. CI keeps them in GitHub Actions secrets.
- The BigQuery service account has one role (BigQuery Job User) in a project with no billing. In CI its key lives in an environment limited to `main` and is written to disk only on runs that query BigQuery.
- CI splits into three jobs. The job that parses downloaded data cannot push or deploy. Dependencies and actions are pinned by hash.
- The Explorer key is read-only.
- Downloaded data is untrusted. It is parsed as JSON or CSV, capped at 40 MB a response, and never executed. Redirects may only land on a fixed list of hosts. Page text goes through `textContent`, and the page sets a strict Content Security Policy.
- Sender and recipient addresses from swap data are kept only as truncated, unsalted hashes on the machine that runs the crawl, and are never committed. Committed aggregates name partners and large fee collectors only.
- The page loads no third-party scripts, sets no cookies and sends nothing anywhere.

Report a problem through GitHub private vulnerability reporting on this repo.