open/.profile
1
0
Fork 0
Code Issues Releases Activity

docs: rebuild org landing page, add LICENSE and SECURITY.md

Browse source 
The README of this repo renders as the org front page on
git.fromaitochitta.com/open. It was 5 lines and 209 bytes: a category
label, and a single navigation link that pointed away from the instance.
A visitor arriving from LinkedIn had no way into the 23 repos without
leaving the site they had just reached.

- README: a thesis (work that can be checked), navigation by purpose in
  five groups covering all 22 other repos, a maturity column read from
  the status-* topics that already exist on 22 of 23 repos, a verified
  two-line install block, and links that go INTO the instance. The link
  to fromaitochitta.com stays, last, as additional context.
- LICENSE: MIT, matching the other repos in the org (closes A8).
- SECURITY.md: org-level contact at the address already published on
  four other repos, with a realistic best-effort response process.

Absolute URLs rather than relative paths: how Forgejo resolves relative
links when rendering .profile/README.md on the org page is not measured,
and a pretty relative path that renders to 404 is worse than a long
absolute one that works. 25 links checked, 24 resolve 200 pre-push; the
25th is SECURITY.md itself. Known-negative control returns 404.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N1mHqwhG7BgaiUkaZ5PC7i
This commit is contained in:
Kjell Tore Guttormsen 2026-08-18 14:34:24 +02:00
commit 9898a6e747
3 changed files with 147 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

39
SECURITY.md Normal file
View file

@ -0,0 +1,39 @@
# Security policy
This repository holds the landing page for the `open` organisation. It
contains no code. The policy below is the security contact for the
organisation as a whole; each repo also carries its own `SECURITY.md`
with its version and disclosure details.
## Reporting a vulnerability
Report privately to <security@fromaitochitta.com> — do not open a public
issue. If the vulnerability is in a specific repo, say which one.
Please include the affected version or commit, a minimal reproduction,
and the impact you see.
## Response process
This is a solo, best-effort project. There is no SLA and no paid support.
What is committed to:
1. Acknowledge within 5 working days.
2. Triage and confirm severity within 10 working days.
3. Develop and test a fix in the affected repo.
4. Credit the reporter in the advisory unless they prefer to stay anonymous.
Aim is to disclose within 90 days of the initial report, with the timeline
agreed with the reporter.
## Supported versions
Every repo here is pre-1.0. Only the latest tagged release of a given repo
receives security fixes; upgrade before reporting. Security-relevant fixes
are recorded in each repo's `CHANGELOG.md`.
## Out of scope
Vulnerabilities in Claude Code itself, in the Claude API, or in third-party
dependencies belong with their own maintainers. Report Claude Code issues to
Anthropic.