Kjell Tore Guttormsen
9898a6e747
The README of this repo renders as the org front page on git.fromaitochitta.com/open. It was 5 lines and 209 bytes: a category label, and a single navigation link that pointed away from the instance. A visitor arriving from LinkedIn had no way into the 23 repos without leaving the site they had just reached. - README: a thesis (work that can be checked), navigation by purpose in five groups covering all 22 other repos, a maturity column read from the status-* topics that already exist on 22 of 23 repos, a verified two-line install block, and links that go INTO the instance. The link to fromaitochitta.com stays, last, as additional context. - LICENSE: MIT, matching the other repos in the org (closes A8). - SECURITY.md: org-level contact at the address already published on four other repos, with a realistic best-effort response process. Absolute URLs rather than relative paths: how Forgejo resolves relative links when rendering .profile/README.md on the org page is not measured, and a pretty relative path that renders to 404 is worse than a long absolute one that works. 25 links checked, 24 resolve 200 pre-push; the 25th is SECURITY.md itself. Known-negative control returns 404. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N1mHqwhG7BgaiUkaZ5PC7i
1.3 KiB
Security policy
This repository holds the landing page for the open organisation. It
contains no code. The policy below is the security contact for the
organisation as a whole; each repo also carries its own SECURITY.md
with its version and disclosure details.
Reporting a vulnerability
Report privately to security@fromaitochitta.com — do not open a public issue. If the vulnerability is in a specific repo, say which one.
Please include the affected version or commit, a minimal reproduction, and the impact you see.
Response process
This is a solo, best-effort project. There is no SLA and no paid support. What is committed to:
- Acknowledge within 5 working days.
- Triage and confirm severity within 10 working days.
- Develop and test a fix in the affected repo.
- Credit the reporter in the advisory unless they prefer to stay anonymous.
Aim is to disclose within 90 days of the initial report, with the timeline agreed with the reporter.
Supported versions
Every repo here is pre-1.0. Only the latest tagged release of a given repo
receives security fixes; upgrade before reporting. Security-relevant fixes
are recorded in each repo's CHANGELOG.md.
Out of scope
Vulnerabilities in Claude Code itself, in the Claude API, or in third-party dependencies belong with their own maintainers. Report Claude Code issues to Anthropic.