NegraRosa is an Inclusive Security Framework that empowers individuals to control their identity and personal data through NFT-based authentication and decentralized verification. The framework enables users to share verified identity information with third-party partners while maintaining full control over their data.
- NFT-Based Identity - "I AM WHO I AM" NFT as central identity token
- User-Controlled Data Sharing - Granular permission controls for data access
- Partner Integration Hub - Seamless integration with third-party verification services
- Zero-Custody Model - No custody of user credentials or private keys
- Comprehensive Audit Trail - All actions logged to append-only audit store
- Security-First Architecture - Built on security pillars with automated checks
Get started in minutes:
# Clone the repository
git clone https://github.com/pinkycollie/NegraRosa.git
cd NegraRosa
# Install dependencies
npm install
# Configure environment
cp .env.example .env
# Edit .env with your settings
# Start development server
npm run devFor detailed setup instructions, see QUICKSTART.md.
- QUICKSTART.md - Quick start guide for developers
- agents.md - Comprehensive agent documentation with security policies
- SECURITY.md - Security policy and vulnerability reporting
- DEPLOY.md - Deployment instructions for Vercel
- Partner Integration API - API specifications for third-party integrations
- docs/README.md - Documentation structure and guidelines
- PR Template - Pull request checklist
- Incident Template - Security incident reporting
NegraRosa is built on seven security pillars:
- Identity & Access - Paseto v4 tokens, short TTL, MFA, RBAC
- Code & CI Hygiene - Pinned deps, SCA, spectral checks, import bans
- Data Minimization - Redaction middleware, no PII persistence by default
- Infrastructure - Domain separation, WAF, rate limits
- Supply-chain - CVE monitoring, rapid backports, SBOM generation
- Observability - Health checks, metrics, audit trails, incident playbook
- AI Safety - Model input/output validation, prompt logging, policy enforcement
For detailed information, see agents.md.
- Frontend: React, TypeScript, Tailwind CSS
- Backend: Node.js, Express, TypeScript
- Database: PostgreSQL with Drizzle ORM
- Authentication: Paseto v4, Passport.js
- Blockchain: Ethereum (for NFT verification)
- Integrations: DeafAuth™, ID.me™ (NIST IAL2), Stripe, Plaid, Auth0, W3C DIDs, OpenAI, Anthropic
- Node.js 20+
- PostgreSQL
- Git
npm run dev # Start development server
npm run build # Build for production
npm start # Start production server
npm run check # TypeScript type checking
npm test # Run tests
npm run db:push # Push database schema changes
npm audit # Security vulnerability checkNegraRosa/
├── .github/ # GitHub workflows and templates
├── api/ # API routes
├── client/ # React frontend
├── server/ # Backend server
│ ├── api/ # API endpoints
│ └── services/ # Business logic
├── docs/ # Documentation
├── shared/ # Shared code
└── agents.md # Agent documentation
Do not report security vulnerabilities through public GitHub issues.
Email security concerns to: security@mbtq.dev
See SECURITY.md for detailed reporting guidelines.
- Never commit secrets to the repository
- Use environment variables for sensitive configuration
- Set
PERSISTENCE=falsein development - Follow the agents.md security guidelines
- Run
npm auditbefore submitting PRs
We welcome contributions! Before contributing:
- Read agents.md for security guidelines
- Review SECURITY.md for security practices
- Check the PR template
- Follow the coding standards in existing code
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Make your changes and add tests
- Run security checks (
npm audit,npm run check) - Commit your changes (
git commit -m 'feat: add amazing feature') - Push to your branch (
git push origin feature/amazing-feature) - Open a Pull Request
All PRs require:
- Passing CI checks
- Security council review (for security-critical changes)
- Updated documentation
Deploy to Vercel:
- Connect your GitHub repository to Vercel
- Configure environment variables in Vercel dashboard
- Deploy
See DEPLOY.md for detailed deployment instructions.
This project is licensed under the MIT License - see the LICENSE file for details.
- Documentation: docs/
- Issues: GitHub Issues
- Security: security@mbtq.dev
- General inquiries: Open a discussion on GitHub
- Pin runtime versions
- Address high/critical CVEs
- Deploy redaction middleware
- Implement Paseto v4 tokens
- Event signing with Ed25519
- Automated key rotation
- Supply-chain attestations
- SBOM generation
- Multi-chain NFT support
- Advanced AI-powered verification
- Decentralized identity network
- Open source ecosystem
See agents.md for detailed security roadmap.
- Security researchers who help keep NegraRosa secure
- Open source community for amazing tools and libraries
- Contributors who make this project possible
Built with ❤️ by the NegraRosa Team
For questions or support, open an issue or contact us at security@mbtq.dev
Welcome to NegraRosa, an innovative security and identity verification framework.
NegraRosa implements comprehensive security practices integrated into every stage of development:
- Daily Security Scans: Automated SAST, secrets detection, and dependency scanning
- Per-Commit Protection: Every code change is analyzed before merge
- Continuous Monitoring: Real-time vulnerability tracking and response
- Security Rituals: Systematic practices at daily, weekly, and quarterly frequencies
📊 View Security Status Dashboard | 📚 Security Documentation
This repository uses an intelligent merge agent that:
- Auto-suggests merge strategies (squash/rebase/merge) based on PR characteristics
- Auto-merges when safe: CI passes ✅, has approval ✅, not draft ✅
- Deletes branches automatically after merge
For maintainers: Use labels force-squash, force-rebase, force-merge, or do-not-merge to control behavior.
📖 Full documentation | 💬 Contact: Security Council
- Security Rituals Framework - Comprehensive security practices
- Security Status Dashboard - Real-time security metrics and workflow status
- Security Training Guide - Developer security training materials
- Threat Modeling Template - Template for security analysis
- PASETO Authentication - Authentication implementation
- Agent Merge Policy - Automated merge strategy
- Partner Integration API - API documentation
- Deployment Guide - Vercel deployment instructions
- Main Documentation - Complete documentation index
The application is automatically deployed to GitHub Pages on every push to main:
- Live URL: https://pinkycollie.github.io/NegraRosa/
- Deployment Status:
For manual deployment instructions and other platforms, see DEPLOY.md.
If you discover a security vulnerability, please follow our responsible disclosure process:
- DO NOT create a public issue
- Contact the Security Council immediately
- Provide detailed information about the vulnerability
See Security Status Dashboard for contact information.
For more information, see the documentation.