open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 1 Activity
llm-ingestion-pipeline-secu.../SECURITY.md
Kjell Tore Guttormsen 6bcb898632 release(0.6.0): the raw-html narrowing ships, and the version claims it already made become true 
The narrowing landed in 736f370 and its prose asserted `0.6.0` in thirteen places
-- README's public front page among them -- while every version surface still read
0.5.0. That is the same defect class the last three commits were spent correcting:
a published number no measurement backs. Two ways out, land it or neutralize the
references; operator chose to cut.

SURFACES MOVED (the eight the 0.5.0 sweep established, plus the ninth verified)

  pyproject.toml           0.5.0 -> 0.6.0
  __init__.py              0.5.0 -> 0.6.0
  CHANGELOG.md             [Unreleased] -> [0.6.0], fresh [Unreleased]
  README.md                badge, `Status: v0.6`, install tag @v0.6.0
  SECURITY.md              support window `0.5.x` -> `0.6.x`
  docs/BRIEF.md            `v0.5 (alpha)` -> `v0.6 (alpha)`
  docs/ADOPTION-BRIEF.md   `v0.5.0` x2, and 717 -> 727 passing
  CLAUDE.md                `v0.5 (alpha)` -> `v0.6`, plus what 0.6.0 changed
  forge description        178 codepoints, carries no version claim -- verified,
                           not moved. A surface can be checked and stay still.

Measurement provenance is left alone, as in 0.5.0: `tests/test_disposition.py`'s
"0.5.0 axis separation", `disposition.py` and `calibration.py` docstrings,
LIMITATIONS' 0.5.0 reference, every dated claim in docs/PLAN-v1.md. Bumping those
falsifies the record rather than updating it.

MINOR, NOT PATCH: 0.6.0 loosens the upload door. A document whose only finding was
a doc-relative URL attribute on an inactive tag name, or an attribute-less
`<base />`, now WARNs where it was held -- 25 documents in the reference corpus, 2
in each wiki corpus.

VERIFIED BEFORE COMMITTING, NOT AFTER

  727 passed; coverage 128/128 recall, 6/6 documented gaps hold
  docs/LIMITATIONS.md: 33 items, README says 33
  rawhtml-census PRODUCTION row equals `A + base-url` on all three populations --
    the shipped predicate measured, not a hypothesis about it
  redos-sweep: 0 candidates of 152 patterns
  docs/fp-sweep.py still imports the private names it reaches into
  no tracked file carries a stale current-state version claim

Still to prove before the tag: `git show` over this commit's README, and a clean
clone install at this sha.
2026-08-11 18:01:36 +02:00

2.5 KiB
Raw Blame History

Security policy

llm-ingestion-guard is a defensive library for LLM ingestion pipelines. Its own security posture matters: a flaw here can silently admit a poisoned artifact into a downstream corpus. Reports are welcome.

Supported versions

The project is pre-1.0 (0.6.x, alpha). Only the latest published version receives fixes; there are no back-ported security branches yet. Pin a version and watch the CHANGELOG.md ### Security entries.

Reporting a vulnerability

Do not open a public issue for a vulnerability. Public disclosure before a fix gives an attacker a window against every downstream consumer.

Instead, report it privately to the maintainer via the canonical repository on Forgejo:

  • Repository: git.fromaitochitta.com/open/llm-ingestion-pipeline-security
  • Contact the maintainer directly through that Forgejo instance (private message / maintainer contact) and mark the subject SECURITY.

Please include:

  • affected version / commit,
  • a minimal reproduction (input → observed disposition/finding vs. expected),
  • the impact you see (e.g. a poisoned artifact that disposes WARN instead of FAIL_SECURE).

Obfuscate any real payloads the same way the test corpus does — build attack strings from chr(0x…) fragments so the report itself does not ship a live carrier.

What counts as a vulnerability

In scope (a real finding):

  • a bypass of a stated control — e.g. an invisible carrier that reaches the persist gate without failing secure, a credential that egresses without a decoded:egress:* / egress:* label, a guard() path that fails open;
  • a prepare_input / screen_output code path that raises instead of failing closed;
  • a ReDoS or unbounded-resource input against the scanner.

Out of scope (documented boundaries — see the Known limitations section of README.md, not vulnerabilities):

  • semantic / factual poisoning invisible to lexicon + entropy;
  • a HIGH finding in trusted prose disposing to WARN (§4.7 trust-scaling);
  • hex-wrapped (non-base64) secret egress;
  • multimodal / binary-layer carriers (OCR, font stego, VBA/macros, encrypted files);
  • the multilingual homoglyph-mix false positive.

If you are unsure whether something is in scope, report it privately anyway.

Disclosure

This is a small project without a formal embargo SLA. The maintainer will acknowledge a report, agree a fix + disclosure timeline with the reporter, and credit the reporter in the CHANGELOG.md ### Security entry unless they prefer to remain anonymous.