Kjell Tore Guttormsen
9898a6e747
The README of this repo renders as the org front page on git.fromaitochitta.com/open. It was 5 lines and 209 bytes: a category label, and a single navigation link that pointed away from the instance. A visitor arriving from LinkedIn had no way into the 23 repos without leaving the site they had just reached. - README: a thesis (work that can be checked), navigation by purpose in five groups covering all 22 other repos, a maturity column read from the status-* topics that already exist on 22 of 23 repos, a verified two-line install block, and links that go INTO the instance. The link to fromaitochitta.com stays, last, as additional context. - LICENSE: MIT, matching the other repos in the org (closes A8). - SECURITY.md: org-level contact at the address already published on four other repos, with a realistic best-effort response process. Absolute URLs rather than relative paths: how Forgejo resolves relative links when rendering .profile/README.md on the org page is not measured, and a pretty relative path that renders to 404 is worse than a long absolute one that works. 25 links checked, 24 resolve 200 pre-push; the 25th is SECURITY.md itself. Known-negative control returns 404. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N1mHqwhG7BgaiUkaZ5PC7i
39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
This repository holds the landing page for the `open` organisation. It
|
|
contains no code. The policy below is the security contact for the
|
|
organisation as a whole; each repo also carries its own `SECURITY.md`
|
|
with its version and disclosure details.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Report privately to <security@fromaitochitta.com> — do not open a public
|
|
issue. If the vulnerability is in a specific repo, say which one.
|
|
|
|
Please include the affected version or commit, a minimal reproduction,
|
|
and the impact you see.
|
|
|
|
## Response process
|
|
|
|
This is a solo, best-effort project. There is no SLA and no paid support.
|
|
What is committed to:
|
|
|
|
1. Acknowledge within 5 working days.
|
|
2. Triage and confirm severity within 10 working days.
|
|
3. Develop and test a fix in the affected repo.
|
|
4. Credit the reporter in the advisory unless they prefer to stay anonymous.
|
|
|
|
Aim is to disclose within 90 days of the initial report, with the timeline
|
|
agreed with the reporter.
|
|
|
|
## Supported versions
|
|
|
|
Every repo here is pre-1.0. Only the latest tagged release of a given repo
|
|
receives security fixes; upgrade before reporting. Security-relevant fixes
|
|
are recorded in each repo's `CHANGELOG.md`.
|
|
|
|
## Out of scope
|
|
|
|
Vulnerabilities in Claude Code itself, in the Claude API, or in third-party
|
|
dependencies belong with their own maintainers. Report Claude Code issues to
|
|
Anthropic.
|