open/portfolio-optimiser-commons
1
0
Fork 0
Code Issues Releases Activity
portfolio-optimiser-commons/SECURITY.md
Kjell Tore Guttormsen ddaae5d637 chore(release): publiseringsklar for open/ — README for standalone rot + MIT + policy-filer 
Commons konsumeres som `shared/`-subtree av to repo som allerede ligger i
`open/`. Innholdet var dermed offentlig fra før, men PEKEREN var det ikke:
`shared/README.md` i open/portfolio-optimiser lenker til `ktg/`-namespacet og
sier «All edits land in commons first (clone it, commit, push there)» — en URL
en fremmed får 404 på. Dette gjør repoet publiserbart under open/.

README: hodet var skrevet som om fila fortsatt lå i en konsuments `shared/`.
H1 var `# shared/ — framework-neutral core`, og innledningen sa «this
repository — the method built on MAF» — som beskriver et ANNET repo når fila
leses fra commons' rot. Siste linje lenket til
docs/plan/2026-06-26-maalbilde-agentic-loop.md, som ikke finnes her (den bor i
portfolio-optimiser). Alle tre rettet; de to konsumentene er nå utgående
lenker, ikke «dette repoet».

Lagt til for `shared-asset`-klassen (repo-standard): LICENSE (MIT, byte-likt
med soesknene) og `## Non-goals`. Klassen krever ikke `## Install` — repoet
vendorers, det installeres ikke.

CONTRIBUTING/SECURITY/CODE_OF_CONDUCT kreves av INGEN klasse; de er med for
konsistens med de to soesknene. CONTRIBUTING er SKREVET OM, ikke kopiert:
soesknenes versjon ber om Pull Requests, men org-ops slo PR-fanen av paa alle
19 repo fordi CONVENTIONS.md publiserer at PR-er ikke aksepteres. Aa kopiere
den ville importert en motsigelse.

SECURITY er omskrevet for et repo uten kjoerbar kode: angrepsflaten er spec-
tekst som binder konsumentene, ikke et avhengighetstre.

Gate: repo-standard v0.2.2, klasse shared-asset — 0 ERROR, 8 passerte. De 3
gjenstaaende WARN er falske positive mot nav-golden-fixturene (bundle-relative
lenker + tilsiktede escape-nyttelaster som IKKE skal resolve). Fixturene er
uroert: de konsumeres som ekte gate av portfolio-optimiser (0d50ab8).

Verifisert foer commit: ingen secrets i sporet innhold eller i historikkens 37
commits; ingen e-post utover org-kontakten; STATE.md og *.local.md fortsatt
usporet.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XuKPjWwJZNUponVrhoyY1
2026-08-04 22:32:17 +02:00

2.5 KiB
Raw Blame History

Security Policy

Reporting a Vulnerability

If you discover a security issue, please report it responsibly.

Please do NOT report security issues through public issues.

How to Report

Email: hello@fromaitochitta.com

Include:

  • Description of the issue
  • Steps to reproduce
  • Potential impact
  • Any suggested fixes (optional)

What to Expect

  • Acknowledgment within 48 hours
  • Regular updates on progress
  • Credit in the fix announcement (if desired)

What the attack surface here actually is

This repository ships no executable code — no package, no pipeline, no CLI. It contains normative specifications, example knowledge bundles, and golden fixtures. There is no dependency tree to keep patched and nothing here that runs on your machine.

That narrows the realistic reports to three kinds, and all three are worth sending:

  1. A specification that mandates unsafe behaviour. The specs are binding on the implementations that consume them, so a weak rule propagates. The ingest specification in particular governs a boundary where untrusted external data enters the system: its credential-reference rule (manifests carry references to credentials, never the credentials themselves) and its verdict-layer reservation exist for this reason. A gap in that text is a real vulnerability report even though no code changes.
  2. A secret or personal data in the repository or its history. The example bundles are synthetic. If you find something that is not, report it — including in the git history, which is public in full.
  3. A fixture that would make a consuming gate pass when it should fail. The golden suites are the only ground truth the implementations check themselves against. A fixture that silently sanctions unsafe behaviour weakens every consumer at once.

Supported Versions

Version Supported
latest ✅
< latest ❌

Consumers vendor this repository as a git subtree, so a fix here reaches them only when they pull. If a report leads to a change in normative text, both reference implementations are notified — but their pull is their own action, on their own schedule.

Scope Note

The portfolio-optimiser method is a technical framework. Deploying organizations own their own data protection, risk, and compliance assessments (DPIA/ROS). The specifications describe technical prerequisites (local-only operation, provenance, no silent egress) but make no compliance guarantees.