open/llm-ingestion-okf
1
0
Fork 0
Code Issues Releases 1 Activity

docs(security): add SECURITY.md with reporting contact and process

Browse source 
Part of the AAA+ program's C-axis (trust) sweep across the open/ org:
a stated vulnerability-reporting address and response process is what a
stranger evaluating the repo looks for before reading any code.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011WZqVHfRgn26fS6neSMU9v
This commit is contained in:
Kjell Tore Guttormsen 2026-08-16 21:15:10 +02:00
commit f23e93df44
1 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
SECURITY.md Normal file
View file

@ -0,0 +1,35 @@
# Security policy
## Reporting a vulnerability
Report privately to <security@fromaitochitta.com> - do not open a
public issue.
Canonical repository: https://git.fromaitochitta.com/open/llm-ingestion-okf
Please include the affected version or commit, a minimal reproduction,
and the impact you see. We acknowledge every report within 5 working
days, agree a fix and disclosure timeline with the reporter, and aim to
disclose within 90 days of the initial report.
## Response process
1. Acknowledge within 5 working days.
2. Triage and confirm severity within 10 working days.
3. Develop and test a fix.
4. Publish an advisory and credit the reporter unless they prefer
to remain anonymous.
## Supported versions
This project has not yet reached 1.0; only the latest tagged release and
`main` receive security fixes.
| Version | Supported |
| ------- | --------- |
| 0.5.x | ✅ |
| < 0.5.0 | ❌ |
## Advisories
Fixed vulnerabilities are documented in [CHANGELOG.md](CHANGELOG.md) under
the release in which the fix shipped.