57 lines
2.0 KiB
Markdown
57 lines
2.0 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
| Version | Security support |
|
|
|---|---|
|
|
| Latest tagged PoC release and current `master` | Supported |
|
|
| Older commits, branches and untagged deployments | Not supported |
|
|
|
|
MobilityOps is a synthetic-data proof of concept, not a production identity,
|
|
payments or public reservation platform. Security fixes target the current
|
|
release line only.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not disclose suspected vulnerabilities through a public issue.
|
|
|
|
Report them privately to `jens@itworx.tech` with:
|
|
|
|
- the affected revision, endpoint or component;
|
|
- reproduction steps and prerequisites;
|
|
- the observed and expected behaviour;
|
|
- the security impact;
|
|
- a minimal proof of concept, without unnecessary personal or secret data.
|
|
|
|
Receipt should be acknowledged within three business days. An initial
|
|
assessment or request for additional evidence should follow within ten
|
|
business days. Remediation timing depends on severity and reproducibility.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- MobilityOps backend, frontend, container and deployment code;
|
|
- authentication, authorization, tenant boundaries and audit integrity;
|
|
- database, outbox, backup and restore behaviour;
|
|
- MobilityOps-owned n8n workflow definitions;
|
|
- RAGcore and MCP Hub integration boundaries implemented in this repository.
|
|
|
|
Out of scope:
|
|
|
|
- denial-of-service or destructive testing against the hosted demo;
|
|
- social engineering, credential stuffing or physical attacks;
|
|
- synthetic demo-data exposure without a security-boundary failure;
|
|
- vulnerabilities solely inside RAGcore, ITWorx MCP Hub, n8n or another
|
|
third-party service. Report those to their respective owners.
|
|
|
|
Do not access data beyond what is required to demonstrate the issue, modify
|
|
shared infrastructure, interrupt other services or retain obtained secrets.
|
|
|
|
## Coordinated disclosure
|
|
|
|
Good-faith research that respects this policy and applicable law will be
|
|
handled constructively. Allow a reasonable remediation period before public
|
|
disclosure. Submitted reports and evidence are used only for investigation,
|
|
remediation and verification.
|