From 03df2db8b6b92b9033622e0cbd5ce2398c28b98f Mon Sep 17 00:00:00 2001 From: Jens Caers Date: Sun, 30 Aug 2026 23:27:04 +0200 Subject: [PATCH] docs: add public security policy --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..1d7e5452 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported code + +Security fixes target the current `main` release line. Historical research, calibration and development branches are not supported release channels unless explicitly documented otherwise. + +## Reporting vulnerabilities + +Report suspected security issues privately to the repository owner. Do not publish credentials, access tokens, private infrastructure details, personal data, sensitive geospatial source material, proprietary datasets, production database contents or exploit-sensitive evidence in a public issue. + +Include the affected commit/component, minimal reproduction conditions using synthetic or public data where possible, expected and observed behaviour, impact, and whether the issue affects authentication, authorization, uploads, archive handling, file paths, report/export generation, AI/model loading, container/deployment boundaries or secret handling. + +## Repository and data hygiene + +Local Codex inputs, calibration databases, contact sheets, runtime data, generated reports and cross-project scratch are not release source and must stay outside version control. The repository ignore rules and release gates are part of this boundary. + +Never commit live `.env` files, production backups, credentials, operator data or private datasets. Public examples and tests should use synthetic or explicitly redistributable material. + +## Disclosure + +Coordinate remediation and disclosure with the repository owner before publishing details that would materially increase exploitation risk.