From d36c5424cd9aba3c2c239c942cfea62d1a583c9a Mon Sep 17 00:00:00 2001 From: Jens Caers Date: Wed, 26 Aug 2026 22:11:39 +0200 Subject: [PATCH] hardening: document security invariants --- SECURITY.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..17b12745 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,42 @@ +# Security policy + +## Supported deployment boundary + +GeoIntel v1 is a controlled single-operator GeoAI workbench. The optional guest +role is a presentation-only capability for a dedicated demo instance; it is not +tenant isolation and is disabled by default. + +## Security invariants + +- Secrets and database credentials are runtime configuration and must never be + committed to Git or baked into container image metadata. +- Operator passwords are stored only as PBKDF2-SHA256 hashes. Browser sessions + are signed, bounded by TTL and carried in HttpOnly cookies. +- Production YOLO inference is fail-closed: a configured model must use CUDA and + remain inside an immutable, checksum-bound validation-scope manifest. +- Provider acquisition must cross the shared outbound request guard, stay within + explicit page/response budgets and fail closed on unexpected origins. +- Local agent scratch, temporary SQLite/WAL state, model weights and generated + operator data are not repository content. +- Release workflows and external container/action dependencies must use immutable + references. CI retains SBOM and vulnerability-policy evidence. +- Guest mode must never be enabled on an instance containing private, customer or + operational data. Use a separate storage root and database for demos. + +## Current scale boundary + +Login throttling is process-local. This is acceptable for the current +single-process/single-node deployment, but it is not a distributed rate limiter. +Before running multiple API processes or hosts, move rate-limit state to a shared +database/Redis boundary and preserve the same failure semantics. + +Analysis jobs are persisted in PostgreSQL and executed by in-process workers. +They are restart-reconciled but are not a distributed durable queue. Horizontal +worker scaling requires leases, attempt counters, idempotency and retry policy +before it is considered supported. + +## Reporting a security issue + +Report suspected vulnerabilities privately through the repository owner's +controlled Gitea channel. Do not include live credentials, private datasets or +production access tokens in issues, screenshots, logs or test fixtures.