Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Security policy
+
+## Supported version
+
+Security fixes are made for the latest released minor version. At the time of publication that is
+ModelForge 1.2.x. Upgrade to the latest patch before reporting a problem that may already be fixed.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability, leaked credential, private topology or
+exploit. Send the report privately to **security@itworx.tech** with:
+
+- the affected version or commit;
+- the component and reachable entry point;
+- reproduction steps or a minimal proof of concept;
+- the impact and any prerequisites you observed;
+- whether you believe active exploitation or credential exposure occurred.
+
+Do not access data that is not yours, degrade a running service, persist access, or publish the
+details before a fix is available. We will acknowledge a usable report, coordinate validation and
+credit, and publish an advisory when users have a remediation.
+
+The repository owner must confirm that `security@itworx.tech` is a monitored mailbox before the
+public repository is enabled. Until then, contact the owner privately through the repository host.
+
+## Security model
+
+Model artifacts are untrusted input. ModelForge resolves immutable upstream revisions, keeps
+downloads in quarantine, verifies their size and digest, performs static inspection, disables
+remote code, and requires evidence plus human approval before production promotion. See
+[docs/security/THREAT_MODEL.md](docs/security/THREAT_MODEL.md) and
+[docs/security/MODEL_SUPPLY_CHAIN_POLICY.md](docs/security/MODEL_SUPPLY_CHAIN_POLICY.md).