Kjell Tore Guttormsen
89e3ad8efe
aa9eaa9 docs(plan): V1-etterspill — §12 mangler rader for `by`/`at`, presedens målt begge veier 54e0ec7 spec(ingest): V1 — `generated` til O2-formen, ratifisert 2026-08-02 ddaae5d chore(release): publiseringsklar for open/ — README for standalone rot + MIT + policy-filer f98b287 docs(plan): V1 RATIFISERT — og :275 er en andre tabellrad, ikke prosa d6bced7 docs(plan): SS11 ankrer ikke SS8 — funnet var reelt, men ikke raden som ble bestilt 3174475 docs(plan): §7.2 — feilanker-failuremoden var ikke hypotetisk, den inntraff a2b57d2 docs(plan): V1 — «de 5 linjene» var ikke homogene; :214 er ikke en literal d63e45d docs(plan): okf-versjonssjekken utført — hypotesen falsifisert på to stale premisser ef31dda docs(plan): V1 §4.2 — pin + id + sitering avgjort, og ratifiseringsgaten funnet git-subtree-dir: shared git-subtree-split: aa9eaa9df06463a8cf00bd28fd133b1f20d7b888
2.5 KiB
Security Policy
Reporting a Vulnerability
If you discover a security issue, please report it responsibly.
Please do NOT report security issues through public issues.
How to Report
Email: hello@fromaitochitta.com
Include:
- Description of the issue
- Steps to reproduce
- Potential impact
- Any suggested fixes (optional)
What to Expect
- Acknowledgment within 48 hours
- Regular updates on progress
- Credit in the fix announcement (if desired)
What the attack surface here actually is
This repository ships no executable code — no package, no pipeline, no CLI. It contains normative specifications, example knowledge bundles, and golden fixtures. There is no dependency tree to keep patched and nothing here that runs on your machine.
That narrows the realistic reports to three kinds, and all three are worth sending:
- A specification that mandates unsafe behaviour. The specs are binding on the implementations that consume them, so a weak rule propagates. The ingest specification in particular governs a boundary where untrusted external data enters the system: its credential-reference rule (manifests carry references to credentials, never the credentials themselves) and its verdict-layer reservation exist for this reason. A gap in that text is a real vulnerability report even though no code changes.
- A secret or personal data in the repository or its history. The example bundles are synthetic. If you find something that is not, report it — including in the git history, which is public in full.
- A fixture that would make a consuming gate pass when it should fail. The golden suites are the only ground truth the implementations check themselves against. A fixture that silently sanctions unsafe behaviour weakens every consumer at once.
Supported Versions
| Version | Supported |
|---|---|
| latest | ✅ |
| < latest | ❌ |
Consumers vendor this repository as a git subtree, so a fix here reaches them only when they
pull. If a report leads to a change in normative text, both reference implementations are
notified — but their pull is their own action, on their own schedule.
Scope Note
The portfolio-optimiser method is a technical framework. Deploying organizations own their own data protection, risk, and compliance assessments (DPIA/ROS). The specifications describe technical prerequisites (local-only operation, provenance, no silent egress) but make no compliance guarantees.