Kjell Tore Guttormsen
74008aebfe
f35a22a fix(skills): eksempelet brøt skillens egen regel — undecided, ikke survived ff7b9b7 docs(spec): Amendment A1 — sources som flow-sekvens + falsification-reviewer-persona b2205b9 docs(plan): kø commons-shared-golden-referent Q4/§6.2 — køplassering, ikke utførelse ba0237d docs(plan): kø commons-spec-amendments (D-A 1/2/4+D-F) — køplassering, ikke utførelse 30e1e71 docs(plan): kø SS11-budsjettfunnet — køplassering, ikke utførelse 38a1178 docs(plan): SS12-underlaget lukket — O-A ratifisert og utført (§9) 0f88324 docs(spec): §12 fører generated-undernøklene `by` og `at` som egne rader (O-A) e307997 docs(plan): kø SS12-undernøklene — køplassering, ikke utførelse 22048ea docs(spec): «step 0 — explore» som informativ merknad; README lover ikke lenger et manglende eksempel 7495cf6 chore(privacy): fjern de tre private identifikatorene fra publiserte filer 6b39f3b docs(readme): Contents lister alle fem eksempelbundler — veglys + tunnel var usynlige 3362e82 fix(security): sikkerhetskontakt security@, ikke hello@ (D6-konsistens) fecdb97 docs(release): CHANGELOG + v0.1.0 — første taggede snitt av det publiserte kjernen git-subtree-dir: shared git-subtree-split: f35a22a3043ba743b8499743d6f2c9c2bb8a579a
62 lines
2.5 KiB
Markdown
62 lines
2.5 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security issue, please report it responsibly.
|
|
|
|
**Please do NOT report security issues through public issues.**
|
|
|
|
### How to Report
|
|
|
|
Email: security@fromaitochitta.com
|
|
|
|
Include:
|
|
- Description of the issue
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Any suggested fixes (optional)
|
|
|
|
### What to Expect
|
|
|
|
- Acknowledgment within 48 hours
|
|
- Regular updates on progress
|
|
- Credit in the fix announcement (if desired)
|
|
|
|
## What the attack surface here actually is
|
|
|
|
This repository ships **no executable code** — no package, no pipeline, no CLI. It contains
|
|
normative specifications, example knowledge bundles, and golden fixtures. There is no dependency
|
|
tree to keep patched and nothing here that runs on your machine.
|
|
|
|
That narrows the realistic reports to three kinds, and all three are worth sending:
|
|
|
|
1. **A specification that mandates unsafe behaviour.** The specs are binding on the
|
|
implementations that consume them, so a weak rule propagates. The ingest specification in
|
|
particular governs a boundary where untrusted external data enters the system: its
|
|
credential-reference rule (manifests carry *references* to credentials, never the credentials
|
|
themselves) and its verdict-layer reservation exist for this reason. A gap in that text is a
|
|
real vulnerability report even though no code changes.
|
|
2. **A secret or personal data in the repository or its history.** The example bundles are
|
|
synthetic. If you find something that is not, report it — including in the git history, which
|
|
is public in full.
|
|
3. **A fixture that would make a consuming gate pass when it should fail.** The golden suites are
|
|
the only ground truth the implementations check themselves against. A fixture that silently
|
|
sanctions unsafe behaviour weakens every consumer at once.
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| latest | :white_check_mark: |
|
|
| < latest| :x: |
|
|
|
|
Consumers vendor this repository as a `git subtree`, so a fix here reaches them only when they
|
|
pull. If a report leads to a change in normative text, both reference implementations are
|
|
notified — but their pull is their own action, on their own schedule.
|
|
|
|
## Scope Note
|
|
|
|
The portfolio-optimiser method is a **technical framework**. Deploying organizations own their
|
|
own data protection, risk, and compliance assessments (DPIA/ROS). The specifications describe
|
|
technical prerequisites (local-only operation, provenance, no silent egress) but make no
|
|
compliance guarantees.
|