open/okr

Kjell Tore Guttormsen 3c240af7ea docs(okr): security-kontaktinfo i SECURITY.md (Scorecard Security-Policy)

Legger til e-postadresse (security@fromaitochitta.com) og https:// foran
Forgejo-URLen. Scorecard 5.5.0 sin Security-Policy-sjekk krever et av disse
to for 6 av 10 poeng; filen manglet begge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GzWwPMeqJcq32iSM7qsR1v

2026-08-16 21:15:14 +02:00

1.6 KiB

Raw Blame History

Security Policy

Supported Versions

Version	Supported
>= 1.0.0	✅

Reporting a Vulnerability

If you discover a security vulnerability, please:

Do not open a public issue
Email security@fromaitochitta.com, or report privately via the Forgejo repository: https://git.fromaitochitta.com/open/okr
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

What to Expect

Acknowledgment within 48 hours
Status update within 7 days
Fix timeline depends on severity

Security Considerations

This plugin handles OKR data which may contain sensitive organizational information:

Data Handling

All processing happens locally in Claude Code
No data is transmitted to external services (except configured integrations)
Linear integration uses your own API credentials

Sensitive Files

The following files contain sensitive data and are gitignored:

File	Contents
`.claude/okr.local.md`	Linear API configuration, team settings
`.mcp.json`	MCP server credentials

Best Practices

Never commit okr.local.md to version control
Use environment variables for API keys when possible
Review OKR content before sharing externally
Consider data classification when tracking sensitive objectives

Linear Integration Security

If using Linear integration:

API keys are stored locally in okr.local.md
Use team-scoped API keys, not personal tokens
Rotate keys periodically
Review Linear's security documentation

1.6 KiB Raw Blame History