# Security Policy

## Reporting a Vulnerability

If you discover a security issue, please report it responsibly.

**Please do NOT report security issues through public issues.**

### How to Report

Email: hello@fromaitochitta.com

Include:
- Description of the issue
- Steps to reproduce
- Potential impact
- Any suggested fixes (optional)

### What to Expect

- Acknowledgment within 48 hours
- Regular updates on progress
- Credit in the fix announcement (if desired)

## What the attack surface here actually is

This repository ships **no executable code** — no package, no pipeline, no CLI. It contains
normative specifications, example knowledge bundles, and golden fixtures. There is no dependency
tree to keep patched and nothing here that runs on your machine.

That narrows the realistic reports to three kinds, and all three are worth sending:

1. **A specification that mandates unsafe behaviour.** The specs are binding on the
   implementations that consume them, so a weak rule propagates. The ingest specification in
   particular governs a boundary where untrusted external data enters the system: its
   credential-reference rule (manifests carry *references* to credentials, never the credentials
   themselves) and its verdict-layer reservation exist for this reason. A gap in that text is a
   real vulnerability report even though no code changes.
2. **A secret or personal data in the repository or its history.** The example bundles are
   synthetic. If you find something that is not, report it — including in the git history, which
   is public in full.
3. **A fixture that would make a consuming gate pass when it should fail.** The golden suites are
   the only ground truth the implementations check themselves against. A fixture that silently
   sanctions unsafe behaviour weakens every consumer at once.

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| latest  | :white_check_mark: |
| < latest| :x:                |

Consumers vendor this repository as a `git subtree`, so a fix here reaches them only when they
pull. If a report leads to a change in normative text, both reference implementations are
notified — but their pull is their own action, on their own schedule.

## Scope Note

The portfolio-optimiser method is a **technical framework**. Deploying organizations own their
own data protection, risk, and compliance assessments (DPIA/ROS). The specifications describe
technical prerequisites (local-only operation, provenance, no silent egress) but make no
compliance guarantees.