altcha 1.0.0 → 2.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8a3ab9fc23e2e62bd9a0355d917260fe5441d5f4980e19f27a9373449409c23
-  data.tar.gz: a0ee5531bb2edccebbedf99db05a6d4b036d0c3425c7dad214b8c3a1c2e9195e
+  metadata.gz: 86a8015b761012e385bf6b5756e3cc06ab6e0918efebcdc7fc244e029c200e69
+  data.tar.gz: 187c01c7e93e15676c755ec9105955447c048c2e2c0249a270a44e735ea41666
 SHA512:
-  metadata.gz: 28ba37f3008fe75770d77138d3eba714bbe6cff6cf1cccda077b4633e83256bbf3ad97479208ab5b79896a46e21aba7fc860d6e3694cc5ba931c2d3673cdbede
-  data.tar.gz: 025f7a66d20e1752bb67ef8f109fde608e3f66327d26af3728d064de0b24cc128b17b09df3ae89f97030b87140420cc87cc21101bc909c1a560aa3281db5b383
+  metadata.gz: 98e5fd75d6640ac91149c917bbc45e6bebe02fa03f1b0d0a201382675579ec8d6e2d8dcc85d17ef608833972b44dfc81df07e7f6f7964ce9da25cb1c47ef1530
+  data.tar.gz: 6daf6a061f5340a93c920ab6e2973b49979b77031c548845ad9a78fc363aed96e1f43e7de561b2f924b4401f5949c4356c1af1cda66a3e44d9ce693d23d1dc18

data/.github/workflows/publish.yml

@@ -0,0 +1,24 @@
+name: Publish gem
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: rubygems
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      - uses: rubygems/release-gem@v1

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+GitHub Issues.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

data/CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing to ALTCHA
+
+We appreciate your contributions! To ensure a smooth and transparent collaboration, we've outlined the various ways you can contribute to ALTCHA:
+
+- **Reporting a Bug**
+- **Discussing the Current State of the Code**
+- **Submitting a Fix**
+- **Proposing New Features**
+- **Becoming a Maintainer**
+
+## Development with GitHub
+
+ALTCHA is hosted on GitHub, where you can find the codebase, track issues, and submit pull requests. Please familiarize yourself with GitHub for effective collaboration.
+
+## Licensing Information
+
+Any contributions you make will be subjected to the project's MIT software license. By submitting code changes, you agree to license your contributions under the same [MIT License](http://choosealicense.com/licenses/mit/) that covers the entire project. If you have any concerns regarding licensing, feel free to reach out to the maintainers.
+
+## Reporting Bugs Using GitHub's [Issues](https://github.com/altcha-org/altcha-lib-rb/issues)
+
+We track public bugs using GitHub issues. Reporting a bug is easy: simply [open a new issue](https://github.com/altcha-org/altcha-lib-rb/issues). Provide detailed information for effective bug resolution.
+
+## Writing Effective Bug Reports
+
+Good bug reports include:
+
+- A quick summary and background of the issue
+- Steps to reproduce the problem
+  - Be specific!
+  - Include sample code if possible
+- Expected vs. actual outcomes
+- Additional notes, such as your hypotheses or unsuccessful attempts to resolve the issue
+
+## License Agreement
+
+By contributing to ALTCHA, you agree that your contributions will be licensed under the project's MIT License. If you have any questions or concerns, please reach out to the maintainers.

data/Gemfile.lock

@@ -1,26 +1,28 @@
 PATH
   remote: .
   specs:
-    altcha (1.0.0)
+    altcha (2.0.0.beta1)
+      base64
 
 GEM
   remote: https://rubygems.org/
   specs:
+    base64 (0.3.0)
     diff-lcs (1.6.2)
     rake (13.3.1)
-    rspec (3.13.1)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
+    rspec-support (3.13.7)
 
 PLATFORMS
   arm64-darwin-23
@@ -28,9 +30,9 @@ PLATFORMS
 
 DEPENDENCIES
   altcha!
-  bundler (~> 4.0.1)
-  rake (~> 13.3.1)
-  rspec (~> 3.0)
+  bundler (~> 4.0)
+  rake (~> 13.3)
+  rspec (~> 3.13)
 
 BUNDLED WITH
-  4.0.1
+  4.0.9

data/README.md

@@ -1,20 +1,18 @@
 # ALTCHA Ruby Library
 
-The ALTCHA Ruby Library is a lightweight, zero-dependency library designed for creating and verifying [ALTCHA](https://altcha.org) challenges.
+The ALTCHA Ruby Library is a lightweight, zero-dependency library designed for creating and verifying [ALTCHA](https://altcha.org) challenges. It supports both the current **PoW v2** protocol and the legacy **PoW v1** protocol.
 
 ## Compatibility
 
-This library is compatible with:
-
 - Ruby 2.7+
 
-## Example
+## Examples
 
-- [Demo server](https://github.com/altcha-org/altcha-starter-rb)
+- [`examples/server.rb`](/examples/server.rb)
 
 ## Installation
 
-To install the ALTCHA Ruby Library, add it to your Gemfile:
+Add to your Gemfile:
 
 ```ruby
 gem 'altcha'
@@ -26,123 +24,241 @@ Then run:
 bundle install
 ```
 
-Alternatively, install it directly using:
+Or install directly:
 
 ```sh
 gem install altcha
 ```
 
+## Optional dependencies
+
+| Algorithm | Gem | System library |
+|---|---|---|
+| `ARGON2ID` | [`argon2-kdf`](https://github.com/ankane/argon2-kdf) | `libargon2` |
+
+The `argon2-kdf` gem is only required if you use the `ARGON2ID` algorithm. Add it to your Gemfile when needed:
+
+```ruby
+gem 'argon2-kdf'
+```
+
+A `LoadError` with an actionable message is raised at runtime if the gem is missing and `ARGON2ID` is requested.
+
 ## Usage
 
-Here’s a basic example of how to use the ALTCHA Ruby Library:
+### PoW v2 (current)
+
+```ruby
+require 'altcha'
+require 'securerandom'
+
+hmac_secret = 'secret hmac key'
+
+# Create a challenge
+options = Altcha::V2::CreateChallengeOptions.new(
+  algorithm: 'PBKDF2/SHA-256',
+  cost: 5_000,
+  counter: SecureRandom.random_number(5_000..10_000),
+  hmac_signature_secret: hmac_secret
+)
+
+challenge = Altcha::V2.create_challenge(options)
+# => #<Altcha::V2::Challenge ...>
+
+# Solve (client-side)
+solution = Altcha::V2.solve_challenge(challenge)
+# => #<Altcha::V2::Solution counter=..., derived_key="...">
+
+# Verify (server-side)
+result = Altcha::V2.verify_solution(challenge, solution, hmac_signature_secret: hmac_secret)
+puts result.verified ? "Verified!" : "Invalid solution."
+```
+
+The payload sent from the client to the server is a JSON object:
+
+```ruby
+payload = Altcha::V2::Payload.new(challenge: challenge, solution: solution)
+json    = payload.to_json  # send this to the server
+
+# Server-side: restore and verify
+restored = Altcha::V2::Payload.from_json(json)
+result   = Altcha::V2.verify_solution(
+  restored.challenge,
+  restored.solution,
+  hmac_signature_secret: hmac_secret
+)
+```
+
+### PoW v1 (legacy)
 
 ```ruby
 require 'altcha'
 
 hmac_key = 'secret hmac key'
 
-# Create a new challenge
-options = Altcha::ChallengeOptions.new(
+# Create a challenge
+options = Altcha::V1::ChallengeOptions.new(
   hmac_key: hmac_key,
-  max_number: 100000 # the maximum random number
+  max_number: 100_000
 )
 
-challenge = Altcha.create_challenge(options)
-
-# Example payload to verify
-payload = {
-  algorithm: challenge.algorithm,
-  challenge: challenge.challenge,
-  number: 12345, # Example number
-  salt: challenge.salt,
-  signature: challenge.signature
-}
+challenge = Altcha::V1.create_challenge(options)
 
-# Verify the solution
-valid = Altcha.verify_solution(payload, hmac_key, true)
-puts valid ? "Solution verified!" : "Invalid solution."
+# Verify a solution submitted by the client
+valid = Altcha::V1.verify_solution(payload, hmac_key, true)
+puts valid ? "Verified!" : "Invalid solution."
 ```
 
-## API
+## V2 API
+
+### `Altcha::V2.create_challenge(options)` → `Challenge`
+
+Creates a new v2 challenge.
+
+**`CreateChallengeOptions`**
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `algorithm` | `String` | — | Key derivation algorithm: `SHA-256`, `SHA-384`, `SHA-512`, `PBKDF2/SHA-256`, `PBKDF2/SHA-384`, `PBKDF2/SHA-512`, `SCRYPT`, `ARGON2ID`. |
+| `cost` | `Integer` | — | Algorithm cost (iterations for PBKDF2/SHA, N for SCRYPT). |
+| `counter` | `Integer` | `nil` | Pre-compute a deterministic key prefix from this counter value. |
+| `data` | `Hash` | `nil` | Arbitrary metadata to embed in the challenge. |
+| `expires_at` | `Integer, Time` | `nil` | Expiration timestamp (Unix seconds or `Time`). |
+| `hmac_signature_secret` | `String` | `nil` | Signs the challenge parameters. Required for `verify_solution`. |
+| `hmac_key_signature_secret` | `String` | `nil` | Signs the derived key (fast-path verification). Requires `counter`. |
+| `key_length` | `Integer` | `32` | Derived key length in bytes. |
+| `key_prefix` | `String` | `'00'` | Hex prefix the derived key must start with. |
+| `key_prefix_length` | `Integer` | `key_length / 2` | Bytes of the derived key used as prefix in deterministic mode. |
+| `memory_cost` | `Integer` | `nil` | Memory cost in KiB (`ARGON2ID`), or block size `r` (`SCRYPT`). |
+| `parallelism` | `Integer` | `nil` | Parallelism factor (`ARGON2ID`, `SCRYPT`). |
+
+---
+
+### `Altcha::V2.solve_challenge(challenge, ...)` → `Solution, nil`
+
+Solves a challenge by iterating counter values until the derived key starts with `key_prefix`.
+
+| Parameter | Type | Default | Description |
+|---|---|---|---|
+| `challenge` | `Challenge` | — | Challenge to solve. |
+| `max_counter` | `Integer, nil` | `nil` | Safety cap on the counter. Returns `nil` if exceeded. |
+| `counter_start` | `Integer` | `0` | Starting counter value. |
+| `counter_step` | `Integer` | `1` | Counter increment per iteration. |
+
+---
+
+### `Altcha::V2.verify_solution(challenge, solution, ...)` → `VerifySolutionResult`
+
+Verifies a submitted solution.
+
+| Parameter | Type | Description |
+|---|---|---|
+| `challenge` | `Challenge` | The original challenge. |
+| `solution` | `Solution` | The submitted solution. |
+| `hmac_signature_secret:` | `String` | Must match the secret used in `create_challenge`. |
+| `hmac_key_signature_secret:` | `String, nil` | Required when `key_signature` is present. |
+| `hmac_algorithm:` | `String` | HMAC digest algorithm (`SHA-256`, `SHA-384`, `SHA-512`). Default: `SHA-256`. |
+
+**`VerifySolutionResult`**
+
+| Field | Type | Description |
+|---|---|---|
+| `verified` | `Boolean` | `true` if the solution is valid. |
+| `expired` | `Boolean` | `true` if the challenge has expired. |
+| `invalid_signature` | `Boolean, nil` | `true` if the challenge signature is missing or wrong. |
+| `invalid_solution` | `Boolean, nil` | `true` if the derived key does not match. |
+| `time` | `Integer` | Verification time in milliseconds. |
+
+---
 
-### `Altcha.create_challenge(options)`
+### `Altcha::V2.verify_server_signature(payload:, hmac_secret:)` → `VerifyServerSignatureResult`
 
-Creates a new challenge for ALTCHA.
+Verifies a server signature payload issued by the ALTCHA backend.
 
-**Parameters:**
+| Parameter | Type | Description |
+|---|---|---|
+| `payload:` | `ServerSignaturePayload` | Decoded payload from the ALTCHA backend. |
+| `hmac_secret:` | `String` | Shared secret used to sign the payload. |
 
-- `options [ChallengeOptions]`:
-  - `algorithm [String]`: Hashing algorithm to use (`SHA-1`, `SHA-256`, `SHA-512`, default: `SHA-256`).
-  - `max_number [Integer]`: Maximum number for the random number generator (default: 1,000,000).
-  - `salt_length [Integer]`: Length of the random salt (default: 12 bytes).
-  - `hmac_key [String]`: Required HMAC key.
-  - `salt [String]`: Optional salt string. If not provided, a random salt will be generated.
-  - `number [Integer]`: Optional specific number to use. If not provided, a random number will be generated.
-  - `expires [Time]`: Optional expiration time for the challenge.
-  - `params [Hash]`: Optional URL-encoded query parameters.
+**`VerifyServerSignatureResult`**
 
-**Returns:** `Challenge`
+| Field | Type | Description |
+|---|---|---|
+| `verified` | `Boolean` | `true` if the payload is valid and unexpired. |
+| `expired` | `Boolean` | `true` if `expire` is in the past. |
+| `invalid_signature` | `Boolean` | `true` if the HMAC signature does not match. |
+| `invalid_solution` | `Boolean` | `true` if `verified` is not `true` in the payload or verification data. |
+| `verification_data` | `Hash, nil` | Parsed verification data with auto-typed values. |
+| `time` | `Integer` | Verification time in milliseconds. |
 
-### `Altcha.verify_solution(payload, hmac_key, check_expires = true)`
+---
 
-Verifies an ALTCHA solution.
+### `Altcha::V2.verify_fields_hash(form_data:, fields:, fields_hash:, algorithm: 'SHA-256')` → `Boolean`
 
-**Parameters:**
+Verifies the SHA digest of selected form fields, matching the `fieldsHash` included in `verification_data`.
 
-- `payload [Hash]`: The solution payload to verify.
-- `hmac_key [String]`: The HMAC key used for verification.
-- `check_expires [Boolean]`: Whether to check if the challenge has expired.
+---
 
-**Returns:** `Boolean`
+### `Altcha::V2.parse_verification_data(data)` → `Hash, nil`
 
-### `Altcha.extract_params(payload)`
+Parses a URL-encoded `verificationData` string into a typed Hash. Booleans, integers, and floats are auto-detected; `fields` and `reasons` are converted to arrays.
 
-Extracts URL parameters from the payload's salt.
+---
 
-**Parameters:**
+### `Altcha::V2.canonical_json(obj)` → `String`
 
-- `payload [Hash]`: The payload containing the salt.
+Produces a canonical (alphabetically sorted keys, compact) JSON string. Used internally for signing.
 
-**Returns:** `Hash`
+---
 
-### `Altcha.verify_fields_hash(form_data, fields, fields_hash, algorithm)`
+### Data classes
 
-Verifies the hash of form fields.
+**`Altcha::V2::Challenge`** — challenge sent to the client.
+- `parameters` — `ChallengeParameters`
+- `signature` — `String, nil`
+- `.from_json(string)` / `#to_json`
 
-**Parameters:**
+**`Altcha::V2::ChallengeParameters`** — all parameters embedded in a challenge.
 
-- `form_data [Hash]`: The form data to hash.
-- `fields [Array<String>]`: The fields to include in the hash.
-- `fields_hash [String]`: The expected hash value.
-- `algorithm [String]`: Hashing algorithm (`SHA-1`, `SHA-256`, `SHA-512`).
+**`Altcha::V2::Solution`** — solution returned by `solve_challenge`.
+- `counter` — `Integer`
+- `derived_key` — `String` (hex)
+- `time` — `Integer, nil` (milliseconds)
 
-**Returns:** `Boolean`
+**`Altcha::V2::Payload`** — combined challenge + solution for client→server transport.
+- `.from_json(string)` / `#to_json`
 
-### `Altcha.verify_server_signature(payload, hmac_key)`
+**`Altcha::V2::ServerSignaturePayload`** — payload from the ALTCHA backend signature verification.
+- `algorithm`, `verification_data`, `signature`, `verified`, `api_key`, `id`
+- `.from_json(string)` / `.from_base64(string)` / `#to_json`
 
-Verifies the server's signature.
+---
 
-**Parameters:**
+## V1 API (legacy)
 
-- `payload [String, ServerSignaturePayload]`: The payload to verify (string or `ServerSignaturePayload`).
-- `hmac_key [String]`: The HMAC key used for verification.
+### `Altcha::V1.create_challenge(options)` → `Challenge`
 
-**Returns:** `[Boolean, ServerSignatureVerificationData]`
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `hmac_key` | `String` | — | Required HMAC key. |
+| `algorithm` | `String` | `SHA-256` | Hashing algorithm (`SHA-1`, `SHA-256`, `SHA-512`). |
+| `max_number` | `Integer` | `1_000_000` | Upper bound for the random number. |
+| `salt_length` | `Integer` | `12` | Random salt length in bytes. |
+| `salt` | `String` | `nil` | Override generated salt. |
+| `number` | `Integer` | `nil` | Override random number. |
+| `expires` | `Time` | `nil` | Challenge expiration time. |
+| `params` | `Hash` | `nil` | Extra URL-encoded parameters embedded in the salt. |
 
-### `Altcha.solve_challenge(challenge, salt, algorithm, max, start)`
+### `Altcha::V1.verify_solution(payload, hmac_key, check_expires = true)` → `Boolean`
 
-Finds a solution to the given challenge.
+### `Altcha::V1.verify_fields_hash(form_data, fields, fields_hash, algorithm)` → `Boolean`
 
-**Parameters:**
+### `Altcha::V1.verify_server_signature(payload, hmac_key)` → `[Boolean, ServerSignatureVerificationData]`
 
-- `challenge [String]`: The challenge hash.
-- `salt [String]`: The challenge salt.
-- `algorithm [String]`: Hashing algorithm (`SHA-1`, `SHA-256`, `SHA-512`).
-- `max [Integer]`: Maximum number to iterate to.
-- `start [Integer]`: Starting number.
+### `Altcha::V1.solve_challenge(challenge, salt, algorithm, max, start)` → `Solution, nil`
 
-**Returns:** `Solution, nil`
+### `Altcha::V1.extract_params(payload)` → `Hash`
 
 ## License
 
-MIT
+MIT

data/SECURITY.md

@@ -0,0 +1,57 @@
+## Security Vulnerability Disclosure Policy
+
+We take security seriously and value the contributions of researchers who act in good faith to help protect our users. If you believe you have found a vulnerability in our services or software, we encourage you to report it responsibly so we can address it promptly.
+
+### Reporting a Vulnerability
+
+Please email your findings to our [security contacts](https://altcha.org/contact#reporting-security-issues).
+To ensure confidentiality, we recommend encrypting your report using our [PGP key](https://altcha.org/pgp/security-public-key.asc).
+
+Your report should include:
+
+- A clear description of the vulnerability.
+- A working proof of concept or detailed steps to reproduce the issue.
+- Relevant logs, screenshots, or code snippets.
+
+We will acknowledge receipt of your report within 5 business days and keep you informed about our investigation.
+
+### In-Scope
+
+We prioritize reports that demonstrate a real, actionable security risk to our software, services, or infrastructure, such as:
+
+- Remote code execution (RCE)
+- Authentication bypass or privilege escalation
+- Server-side request forgery (SSRF)
+- Cross-site scripting (XSS) or CSRF with significant impact
+
+### Out-of-Scope
+
+To minimize automated noise, the following are generally excluded from our review process:
+
+- Automated results: Reports generated by scanners that lack a manual, actionable proof of exploitability.
+- Configuration & Hygiene: Missing HTTP headers, TLS/SSL configurations, DNS records, or server banners.
+- Volume-based attacks: Denial of Service (DoS/DDoS) or rate-limiting issues.
+- Low-impact: Clickjacking on non-sensitive pages, or bugs requiring jailbroken devices/unsupported browsers.
+- Third-party: Issues in libraries or services not directly managed by us.
+
+### Responsible Disclosure Guidelines
+
+To remain in good standing with our team, we ask that you:
+
+- Do not publicly disclose vulnerabilities before we have confirmed a fix.
+- Do not access, modify, or delete data that does not belong to you.
+- Avoid any actions that could degrade or disrupt our services.
+
+We appreciate the efforts of the security community in helping us maintain a safe environment.
+
+### Disclaimer
+
+This is a voluntary disclosure program rooted in the spirit of open-source collaboration. We operate this program to benefit the broader community and ensure the collective safety of our users. We do not offer any form of compensation for submitted reports. By submitting a report, you acknowledge that you are doing so without expectation of payment and waive any future claims for compensation.
+
+### Related
+
+- [Security Advisory](https://altcha.org/security-advisory)
+
+---
+
+Updated: Feb 4, 2026

data/altcha.gemspec

@@ -12,6 +12,7 @@ Gem::Specification.new do |spec|
   spec.description   = "A lightweight library for creating and verifying ALTCHA challenges."
   spec.homepage      = "https://altcha.org"
   spec.license       = "MIT"
+  spec.required_ruby_version = ">= 2.7"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
@@ -22,7 +23,9 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 4.0.1"
-  spec.add_development_dependency "rake", "~> 13.3.1"
-  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_dependency "base64"
+
+  spec.add_development_dependency "bundler", "~> 4.0"
+  spec.add_development_dependency "rake", "~> 13.3"
+  spec.add_development_dependency "rspec", "~> 3.13"
 end