Kjell Tore Guttormsen 1b0a9a338e docs: add SECURITY.md

AAA+ program round 3 (C-axis, trust). No file existed before; new
vulnerability-reporting policy at repo root, matching the org-wide
10/10 template from the coordinated round.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF8cJYs2vZazMisAd95nfM

2026-08-16 21:14:18 +02:00

1,016 B

Raw Blame History

Security policy

Reporting a vulnerability

Report privately to security@fromaitochitta.com — do not open a public issue. Canonical repository: https://git.fromaitochitta.com/open/repo-standard

Please include the affected version or commit, a minimal reproduction, and the impact you see. We acknowledge every report within 5 working days, agree a fix and disclosure timeline with the reporter, and aim to disclose within 90 days of the initial report.

Response process

Acknowledge within 5 working days.
Triage and confirm severity within 10 working days.
Develop and test a fix.
Publish an advisory and credit the reporter unless they prefer to remain anonymous.

Supported versions

Version	Supported
0.11.x	✅
< 0.11	❌

This project has not reached 1.0 yet; only the latest 0.x release line receives security fixes. See CHANGELOG.md for release history.

Advisories

No advisories have been published yet.