Kjell Tore Guttormsen
f6f98edb1d
D-census 20/21.08 measured llms.txt missing in 23 of 23 org repos, and this repo among four naming hello@ as its security contact. Two operator decisions from 21.08 land here. llms.txt: the reader is an AI agent already standing in the repo, not a crawler (GPTBot/ClaudeBot/Google-Extended skip /llms.txt in practice, so that is never the argument). The README carries three code blocks; the entrance is the first one, and nothing in the file says so. llms.txt names it and quotes that block byte-for-byte -- sha256 of README:45-48 equals sha256 of llms.txt:13-16, so a rewritten variant cannot drift in unnoticed. Kept minimal: H1, one blockquote, the command, two link sections. All 9 link targets verified to exist on disk. llms.txt is a convention, not a ratified standard (a June 2026 W3C proposal makes four substantive changes, which four is NOT verified here) -- another reason to keep it small. SECURITY.md: hello@ works and is not a dead address; the defect is that a reporter comparing two repos from the same org sees two addresses and has to guess which one is the security channel. security@ is the designated one and the operator confirmed it works. Only the security contact moved. hello@ stays in CODE_OF_CONDUCT.md, where it is correct. shared/SECURITY.md carries the same hello@, but shared/ is a pull-only subtree of portfolio-optimiser-commons -- untouched here, reported to its owner instead. 923 tests still green. No version bump, no tag, no publish. Order: 20260821T041218Z-8541228824-from-.claude Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PmgNBXGNpDvUALdGBBhiK8
44 lines
1.2 KiB
Markdown
44 lines
1.2 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take security seriously. If you discover a security vulnerability, please report it responsibly.
|
|
|
|
**Please do NOT report security vulnerabilities through public issues.**
|
|
|
|
### How to Report
|
|
|
|
Email: security@fromaitochitta.com
|
|
|
|
Include:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Any suggested fixes (optional)
|
|
|
|
### What to Expect
|
|
|
|
- Acknowledgment within 48 hours
|
|
- Regular updates on progress
|
|
- Credit in the fix announcement (if desired)
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| latest | :white_check_mark: |
|
|
| < latest| :x: |
|
|
|
|
## Security Best Practices
|
|
|
|
When using portfolio-optimiser-claude:
|
|
- Keep dependencies updated
|
|
- Keep your Claude API key in environment variables — never commit secrets
|
|
- Follow the principle of least privilege for any data-source credentials
|
|
|
|
## Scope Note
|
|
|
|
portfolio-optimiser-claude is a **technical framework**. Deploying organizations own their own
|
|
data protection, risk, and compliance assessments (DPIA/ROS). The framework ships technical
|
|
prerequisites (provenance stamping, a mandatory deterministic validator, an offline-by-default
|
|
test suite) but makes no compliance guarantees.
|