# Announcing the /grin-security repo

**URL:** <https://forum.grin.mw/t/announcing-the-grin-security-repo/6105>\
**Category:** Announcements\
**Created:** [September 19, 2019, 9:25am UTC](https://forum.grin.mw/t/announcing-the-grin-security-repo/6105 "2019-09-19T09:25:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![lehnberg](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.grin.mw/lehnberg/32/159_2.png) [@lehnberg](https://forum.grin.mw/u/lehnberg)\
**Post date:** [September 19, 2019, 9:25am UTC](https://forum.grin.mw/t/announcing-the-grin-security-repo/6105/1 "2019-09-19T09:25:53Z")

</div>

Following discussion with @joltz and the core team, a new repository has been created, focused on security: [https://github.com/mimblewimble/grin-security](https://github.com/mimblewimble/grin-security)

## Motivation

This was triggered by this PR: [https://github.com/mimblewimble/grin/pull/3009](https://github.com/mimblewimble/grin/pull/3009)

When adding canaries, doing it in the SECURITY.MD document itself makes it messy for reviewers to verify, and difficult in general to keep track of historical canaries. It’s preferred to keep the canaries as `.txt` files, but it doesn’t make sense to do that in the node repo.

A dedicated repo makes it easier for us to keep security related data in one place. Right now for example our [libsecp audit is stored under /site/audits](https://github.com/mimblewimble/site/tree/master/audits) which probably doesn’t make a lot of sense.

## Proposed contents of /grin-security

- audit reports
- canaries
- pgp keys
- CVE incident details

We’d probably keep [SECURITY.md](https://github.com/mimblewimble/grin/blob/master/SECURITY.md) in the `/grin` repo as is, in order to take advantage of the GitHub feature of displaying the info to users when opening an issue. But we’d link to it from the security repo and from grin-wallet as well, and anywhere else it is relevant.

## Prior art

An example of a security repo used in other projects is [https://github.com/QubesOS/qubes-secpack](https://github.com/QubesOS/qubes-secpack)

## Feedback, questions suggestions

Please raise in thread.