open/portfolio-optimiser
1
0
Fork 0
Code Issues Releases 1 Activity
portfolio-optimiser/SECURITY.md
Kjell Tore Guttormsen e0fa223591 Squashed 'shared/' changes from a2b57d2..ddaae5d 
ddaae5d chore(release): publiseringsklar for open/ — README for standalone rot + MIT + policy-filer
f98b287 docs(plan): V1 RATIFISERT — og :275 er en andre tabellrad, ikke prosa
d6bced7 docs(plan): SS11 ankrer ikke SS8 — funnet var reelt, men ikke raden som ble bestilt
3174475 docs(plan): §7.2 — feilanker-failuremoden var ikke hypotetisk, den inntraff

git-subtree-dir: shared
git-subtree-split: ddaae5d637ba4ee8425291d99cfe5c8f7b632001
2026-08-05 08:24:14 +02:00

2.5 KiB
Raw Blame History

Security Policy

Reporting a Vulnerability

If you discover a security issue, please report it responsibly.

Please do NOT report security issues through public issues.

How to Report

Email: hello@fromaitochitta.com

Include:

  • Description of the issue
  • Steps to reproduce
  • Potential impact
  • Any suggested fixes (optional)

What to Expect

  • Acknowledgment within 48 hours
  • Regular updates on progress
  • Credit in the fix announcement (if desired)

What the attack surface here actually is

This repository ships no executable code — no package, no pipeline, no CLI. It contains normative specifications, example knowledge bundles, and golden fixtures. There is no dependency tree to keep patched and nothing here that runs on your machine.

That narrows the realistic reports to three kinds, and all three are worth sending:

  1. A specification that mandates unsafe behaviour. The specs are binding on the implementations that consume them, so a weak rule propagates. The ingest specification in particular governs a boundary where untrusted external data enters the system: its credential-reference rule (manifests carry references to credentials, never the credentials themselves) and its verdict-layer reservation exist for this reason. A gap in that text is a real vulnerability report even though no code changes.
  2. A secret or personal data in the repository or its history. The example bundles are synthetic. If you find something that is not, report it — including in the git history, which is public in full.
  3. A fixture that would make a consuming gate pass when it should fail. The golden suites are the only ground truth the implementations check themselves against. A fixture that silently sanctions unsafe behaviour weakens every consumer at once.

Supported Versions

Version Supported
latest ✅
< latest ❌

Consumers vendor this repository as a git subtree, so a fix here reaches them only when they pull. If a report leads to a change in normative text, both reference implementations are notified — but their pull is their own action, on their own schedule.

Scope Note

The portfolio-optimiser method is a technical framework. Deploying organizations own their own data protection, risk, and compliance assessments (DPIA/ROS). The specifications describe technical prerequisites (local-only operation, provenance, no silent egress) but make no compliance guarantees.