Kjell Tore Guttormsen
f23e93df44
Part of the AAA+ program's C-axis (trust) sweep across the open/ org: a stated vulnerability-reporting address and response process is what a stranger evaluating the repo looks for before reading any code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011WZqVHfRgn26fS6neSMU9v
35 lines
1 KiB
Markdown
35 lines
1 KiB
Markdown
# Security policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Report privately to <security@fromaitochitta.com> - do not open a
|
|
public issue.
|
|
Canonical repository: https://git.fromaitochitta.com/open/llm-ingestion-okf
|
|
|
|
Please include the affected version or commit, a minimal reproduction,
|
|
and the impact you see. We acknowledge every report within 5 working
|
|
days, agree a fix and disclosure timeline with the reporter, and aim to
|
|
disclose within 90 days of the initial report.
|
|
|
|
## Response process
|
|
|
|
1. Acknowledge within 5 working days.
|
|
2. Triage and confirm severity within 10 working days.
|
|
3. Develop and test a fix.
|
|
4. Publish an advisory and credit the reporter unless they prefer
|
|
to remain anonymous.
|
|
|
|
## Supported versions
|
|
|
|
This project has not yet reached 1.0; only the latest tagged release and
|
|
`main` receive security fixes.
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.5.x | ✅ |
|
|
| < 0.5.0 | ❌ |
|
|
|
|
## Advisories
|
|
|
|
Fixed vulnerabilities are documented in [CHANGELOG.md](CHANGELOG.md) under
|
|
the release in which the fix shipped.
|