Kjell Tore Guttormsen 7656e93330 docs(security): add SECURITY.md vulnerability disclosure policy

AAA+ programme round 3 (C-axis: trust). Establishes a consistent
security contact and disclosure process across org repos.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018KSq9qC3NCaL6pNgVvxTCK

2026-08-16 21:16:04 +02:00

977 B

Raw Blame History

Security policy

Reporting a vulnerability

Report privately to security@fromaitochitta.com - do not open a public issue. Canonical repository: https://git.fromaitochitta.com/open/ai-psychosis

Please include the affected version or commit, a minimal reproduction, and the impact you see. We acknowledge every report within 5 working days, agree a fix and disclosure timeline with the reporter, and aim to disclose within 90 days of the initial report.

Response process

Acknowledge within 5 working days.
Triage and confirm severity within 10 working days.
Develop and test a fix.
Publish an advisory and credit the reporter unless they prefer to remain anonymous.

Supported versions

Version	Supported
1.x	Yes

This repository has released only the 1.x line (currently 1.2.2); there is no earlier supported line.

Advisories

Security-relevant fixes are recorded in CHANGELOG.md.