hardening: document security invariants

2026-08-26 22:11:39 +02:00
parent 82458b4d29
commit d36c5424cd
1 changed files with 42 additions and 0 deletions
@@ -0,0 +1,42 @@
+# Security policy
+
+## Supported deployment boundary
+
+GeoIntel v1 is a controlled single-operator GeoAI workbench. The optional guest
+role is a presentation-only capability for a dedicated demo instance; it is not
+tenant isolation and is disabled by default.
+
+## Security invariants
+
+- Secrets and database credentials are runtime configuration and must never be
+  committed to Git or baked into container image metadata.
+- Operator passwords are stored only as PBKDF2-SHA256 hashes. Browser sessions
+  are signed, bounded by TTL and carried in HttpOnly cookies.
+- Production YOLO inference is fail-closed: a configured model must use CUDA and
+  remain inside an immutable, checksum-bound validation-scope manifest.
+- Provider acquisition must cross the shared outbound request guard, stay within
+  explicit page/response budgets and fail closed on unexpected origins.
+- Local agent scratch, temporary SQLite/WAL state, model weights and generated
+  operator data are not repository content.
+- Release workflows and external container/action dependencies must use immutable
+  references. CI retains SBOM and vulnerability-policy evidence.
+- Guest mode must never be enabled on an instance containing private, customer or
+  operational data. Use a separate storage root and database for demos.
+
+## Current scale boundary
+
+Login throttling is process-local. This is acceptable for the current
+single-process/single-node deployment, but it is not a distributed rate limiter.
+Before running multiple API processes or hosts, move rate-limit state to a shared
+database/Redis boundary and preserve the same failure semantics.
+
+Analysis jobs are persisted in PostgreSQL and executed by in-process workers.
+They are restart-reconciled but are not a distributed durable queue. Horizontal
+worker scaling requires leases, attempt counters, idempotency and retry policy
+before it is considered supported.
+
+## Reporting a security issue
+
+Report suspected vulnerabilities privately through the repository owner's
+controlled Gitea channel. Do not include live credentials, private datasets or
+production access tokens in issues, screenshots, logs or test fixtures.