2.1 KiB
Security Policy
Supported versions
| Version | Security support |
|---|---|
Latest tagged PoC release and current master |
Supported |
| Older commits, branches and untagged deployments | Not supported |
MobilityOps is a synthetic-data proof of concept, not a production identity, payments or public reservation platform. Security fixes target the current release line only.
Reporting a vulnerability
Do not disclose suspected vulnerabilities through a public issue.
Report them privately to security@itworx.tech with:
- the affected revision, endpoint or component;
- reproduction steps and prerequisites;
- the observed and expected behaviour;
- the security impact;
- a minimal proof of concept, without unnecessary personal or secret data.
Receipt should be acknowledged within three business days. An initial assessment or request for additional evidence should follow within ten business days. Remediation timing depends on severity and reproducibility.
Scope
In scope:
- MobilityOps backend, frontend, container and deployment code;
- authentication, authorization, tenant boundaries and audit integrity;
- database, outbox, backup and restore behaviour;
- MobilityOps-owned n8n workflow definitions;
- RAGcore and MCP Hub integration boundaries implemented in this repository.
Out of scope:
- denial-of-service or destructive testing against the hosted demo;
- social engineering, credential stuffing or physical attacks;
- synthetic demo-data exposure without a security-boundary failure;
- vulnerabilities solely inside RAGcore, ITWorx MCP Hub, n8n or another third-party service. Report those to their respective owners.
Do not access data beyond what is required to demonstrate the issue, modify shared infrastructure, interrupt other services or retain obtained secrets.
Coordinated disclosure
Good-faith research that respects this policy and applicable law will be handled constructively. Allow a reasonable remediation period before public disclosure. Submitted reports and evidence are used only for investigation, remediation and verification.