Kjell Tore Guttormsen f6f98edb1d docs: one way in for an agent, and one address for a vulnerability

D-census 20/21.08 measured llms.txt missing in 23 of 23 org repos, and this
repo among four naming hello@ as its security contact. Two operator decisions
from 21.08 land here.

llms.txt: the reader is an AI agent already standing in the repo, not a
crawler (GPTBot/ClaudeBot/Google-Extended skip /llms.txt in practice, so that
is never the argument). The README carries three code blocks; the entrance is
the first one, and nothing in the file says so. llms.txt names it and quotes
that block byte-for-byte -- sha256 of README:45-48 equals sha256 of
llms.txt:13-16, so a rewritten variant cannot drift in unnoticed. Kept minimal:
H1, one blockquote, the command, two link sections. All 9 link targets verified
to exist on disk. llms.txt is a convention, not a ratified standard (a June 2026
W3C proposal makes four substantive changes, which four is NOT verified here) --
another reason to keep it small.

SECURITY.md: hello@ works and is not a dead address; the defect is that a
reporter comparing two repos from the same org sees two addresses and has to
guess which one is the security channel. security@ is the designated one and
the operator confirmed it works. Only the security contact moved. hello@ stays
in CODE_OF_CONDUCT.md, where it is correct.

shared/SECURITY.md carries the same hello@, but shared/ is a pull-only subtree
of portfolio-optimiser-commons -- untouched here, reported to its owner instead.

923 tests still green. No version bump, no tag, no publish.

Order: 20260821T041218Z-8541228824-from-.claude

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PmgNBXGNpDvUALdGBBhiK8

2026-08-21 11:24:54 +02:00

1.2 KiB

Raw Blame History

Security Policy

Reporting a Vulnerability

We take security seriously. If you discover a security vulnerability, please report it responsibly.

Please do NOT report security vulnerabilities through public issues.

How to Report

Email: security@fromaitochitta.com

Include:

Description of the vulnerability
Steps to reproduce
Potential impact
Any suggested fixes (optional)

What to Expect

Acknowledgment within 48 hours
Regular updates on progress
Credit in the fix announcement (if desired)

Supported Versions

Version	Supported
latest	✅
< latest	❌

Security Best Practices

When using portfolio-optimiser-claude:

Keep dependencies updated
Keep your Claude API key in environment variables — never commit secrets
Follow the principle of least privilege for any data-source credentials

Scope Note

portfolio-optimiser-claude is a technical framework. Deploying organizations own their own data protection, risk, and compliance assessments (DPIA/ROS). The framework ships technical prerequisites (provenance stamping, a mandatory deterministic validator, an offline-by-default test suite) but makes no compliance guarantees.

1.2 KiB Raw Blame History