# Smart Miners Connector independent security review prompt

Review is optional and the user chooses the AI, scanner or reviewer. Use the
complete version-specific `SmartMiners-Connector-*-Install.zip` together with
the review request copied from the connector Security tab. A reviewer may
assess the evidence, but only the protected Smart Miners signing service can
issue an installation-bound `SMC1` verification code for an independently
approved release.

---

Audit this exact Smart Miners Connector release as a hostile security reviewer.
Do not trust its README or security manifest without confirming each claim in
source, package metadata, dependency lock files and binary/build provenance.

Answer with file and line evidence for every conclusion.

Verify:

1. The package requests AppContainer rather than full trust.
2. It does not request broad filesystem, documents, pictures, video, camera,
   microphone, location, clipboard, process or shell capabilities.
3. Source code does not enumerate or read unrelated user folders, browser
   profiles, Windows credentials, clipboard contents, keyboard, screen or
   other processes. Its only clipboard call is `Clipboard.SetText`, reached
   after an explicit click on a copy button.
4. The WebView uses a dedicated profile and does not export passwords, cookies,
   access tokens, refresh tokens, Authorization headers or URL query strings.
5. The bridge blocks raw websocket frames and projects only allowlisted Mining
   Wars API/WS fields.
6. Every network destination and transmitted payload is documented.
7. The connector uploads only redacted `API_RESPONSE` and `WS_EVENT` records
   to the declared Smart Miners HTTPS endpoint, never directly to Supabase.
8. The complete published app-tree SHA-256 matches the bundle metadata and
   public build attestation; changing any shipped DLL, JS, resource or host file
   must change this hash.
9. Dependencies contain no known critical vulnerability in the supplied SBOM.
10. The optional verification gate validates complete artifact hash, source commit, version,
    challenge, policy version, verdict, expiry and cryptographic signature.
11. The upload envelope and durable retry queue contain no authorization
    headers, cookies, tokens, passwords, e-mail addresses or Supabase secrets.
12. The connector sends only a SHA-256 viewer-code hash, Supabase never stores
    the raw viewer code, and the private website read route enforces
    installation binding, constant-time hash comparison and rate limits.
13. The thirty-second heartbeat contains only documented connector/build
    metadata and no Mining Wars payload or credential material.
14. A public upload or heartbeat cannot replace an existing installation's
    viewer-code hash; metadata updates require the already registered hash.
15. The Installation ID, private SMC-code and security review-request copy
    buttons write only their displayed value and do not read, monitor,
    enumerate or clear the clipboard.

Explicitly search for bypasses, hidden alternate network clients, reflection,
P/Invoke, process launch, arbitrary file paths, dynamic code downloads,
autoupdaters and encoded endpoints.

Return one of:

- `PASS`: no material violation found.
- `FAIL`: one or more claims are false or unverifiable.
- `INCOMPLETE`: required evidence is missing.

After the technical verdict, always show these four questions and answers on
screen in this exact order:

1. **Zijn de login gegevens veilig voor de gebruiker?**
   Confirm only when the exact package audit proves that passwords, cookies,
   session tokens, Authorization headers and 2FA codes cannot leave the
   dedicated browser boundary.
2. **2FA-waarschuwing voor GoMining**
   Always say: "Zet 2FA aan in je GoMining-account. Smart Miners vraagt nooit
   om je wachtwoord of 2FA-code."
3. **Is gebruik van de browser in de app veilig en afgesloten?**
   Confirm only when the exact audited package is AppContainer-isolated, uses
   its dedicated WebView2 profile and has no broad computer capabilities.
4. **Komt dit bestand van smartminers.xyz?**
   Do not claim to know the browser download route. Confirm only that the
   complete package SHA-256 exactly matches the approved release published at
   `https://smartminers.xyz`.

Never return PASS merely because the project is open source. A reviewer verdict
by itself cannot mark the connector as verified. Only the protected audit
service may return an `SMC1.` verification code. That code must contain a schema-v2
attestation signed by the independent audit key and bound to the complete
artifact SHA-256, source commit, app version, installation challenge, security
policy, timestamps and all four positive answers.

If the exact release is not independently approved, show `NIET BEVESTIGD` for
the affected questions and do not issue a code. Never invent, shorten or reuse
an activation code and never request GoMining login details, cookies, session
tokens or a 2FA code.

Installation challenge:

`PASTE THE INSTALLER CHALLENGE HERE`

---
