From b486285027217829b8bb9b60707cb4f82b2c3ead Mon Sep 17 00:00:00 2001 From: Jens Caers Date: Sun, 30 Aug 2026 23:17:57 +0200 Subject: [PATCH] docs: add top-level security entry point --- SECURITY.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..40a8a88 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,9 @@ +# Security Policy + +ForgeFlow's detailed security model is documented in [`docs/SECURITY.md`](docs/SECURITY.md). + +Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea tokens, SSH credentials, update-signing material, private server addresses, support bundles containing sensitive data or other operational secrets in a public issue. + +For a useful report, include the affected ForgeFlow version/commit, component, minimal reproduction steps, expected and observed behaviour and security impact. Use sanitized or synthetic repository/server data whenever possible. + +The current release model requires exact-commit verification, origin-constrained credential use, signed update manifests, redacted diagnostics and bounded deployment adapters. Changes must not silently weaken those guarantees.