From 5f7f0a5cbf8c9bf3cb1e9ff9e31cf7706ae8be2c Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 12:50:13 -0400 Subject: [PATCH 1/4] docs: say who qualifies for private repository access "Downstream teams" did not settle whether an exchange running the software qualifies, and the policy tells teams not to pass patch source to validators or node operators, so a professional operator read both halves and found itself on the wrong side of one of them. Chain development teams and major exchange partners qualify, through KYC and directly from us. The restriction on passing source on is unchanged, because it governs redistribution rather than who can be granted access. Raised by Eric reviewing the security blog draft. --- SECURITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index eff3567..7633850 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -96,9 +96,10 @@ Cosmos EVM and the CosmWasm repositories, and is not limited to them. They are named for the repository and the month, for example `cosmos-sdk-priv-july-2026`. -Access is granted to downstream teams that have passed KYC and run the -repository in production. Each month's repositories are created fresh and -collaborators are reinvited, which keeps the access list current. They are +Access is granted to chain development teams and to major exchange partners that +have passed KYC and run the repository in production. Each month's repositories +are created fresh and collaborators are reinvited, which keeps the access list +current. They are rebased periodically against `main` and the maintained release branches, so they stay current with their public counterparts. From 4720ead263286288bc80ad12f375620ca4074031 Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 12:57:32 -0400 Subject: [PATCH 2/4] docs: require KYC of both groups, not just exchange partners The relative clause attached only to the second group, so the sentence could be read as granting chain development teams access without KYC or a production deployment. --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 7633850..f29837b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -96,8 +96,8 @@ Cosmos EVM and the CosmWasm repositories, and is not limited to them. They are named for the repository and the month, for example `cosmos-sdk-priv-july-2026`. -Access is granted to chain development teams and to major exchange partners that -have passed KYC and run the repository in production. Each month's repositories +Access is granted to chain development teams and to major exchange partners. +Both must have passed KYC and run the repository in production. Each month's repositories are created fresh and collaborators are reinvited, which keeps the access list current. They are rebased periodically against `main` and the maintained release branches, so they From 93de6245ab0457dde92bc2acf2d6ce60f779b22f Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 12:57:56 -0400 Subject: [PATCH 3/4] docs: rewrap --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index f29837b..5b81bc9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -97,9 +97,9 @@ are named for the repository and the month, for example `cosmos-sdk-priv-july-2026`. Access is granted to chain development teams and to major exchange partners. -Both must have passed KYC and run the repository in production. Each month's repositories -are created fresh and collaborators are reinvited, which keeps the access list -current. They are +Both must have passed KYC and run the repository in production. Each month's +repositories are created fresh and collaborators are reinvited, which keeps the +access list current. They are rebased periodically against `main` and the maintained release branches, so they stay current with their public counterparts. From 6a0d89c3b30e343c60890f8e1b6b8cbf17efc65d Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 12:58:03 -0400 Subject: [PATCH 4/4] docs: rewrap the rest of the paragraph --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 5b81bc9..fca4412 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -99,9 +99,9 @@ are named for the repository and the month, for example Access is granted to chain development teams and to major exchange partners. Both must have passed KYC and run the repository in production. Each month's repositories are created fresh and collaborators are reinvited, which keeps the -access list current. They are -rebased periodically against `main` and the maintained release branches, so they -stay current with their public counterparts. +access list current. They are rebased periodically against `main` and the +maintained release branches, so they stay current with their public +counterparts. ### Patch detail