NuklearRabbit
3969a35d7a
Managed validation / Managed repository validation (pull_request) Successful in 1m54s
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Successful in 1m53s
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Failing after 20s
GeoIntel release gates / Production AI image, SBOM and container scan (pull_request) Failing after 12m1s
GeoIntel release gates / Deploy exact gated revision to Unraid (pull_request) Skipped
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
# Security Policy
|
|
|
|
## Supported code
|
|
|
|
Security fixes target the current `main` release line. Historical research,
|
|
calibration and development branches are not supported release channels unless
|
|
explicitly documented otherwise.
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Report suspected security issues privately to `security@itworx.tech`. Do not put
|
|
credentials, access tokens, private infrastructure, precise sensitive
|
|
locations, proprietary imagery or datasets, model artifacts, production
|
|
database contents, personal data or exploit-sensitive evidence in a public
|
|
issue.
|
|
|
|
Include the affected commit and component, minimal reproduction conditions
|
|
using synthetic or public data where possible, expected and observed
|
|
behaviour, impact, and whether the issue affects ingestion, geospatial
|
|
processing, authentication or authorization, uploads, archive or path handling,
|
|
model inference, reports and exports, deployment, data retention or secrets.
|
|
|
|
## Repository and data boundary
|
|
|
|
Geospatial inputs and derived outputs can reveal people, assets and sensitive
|
|
locations. Treat screenshots, contact sheets, coordinates, source archives,
|
|
SQLite/WAL state, model output and exports as potentially sensitive. These
|
|
belong in controlled external storage, not the source repository.
|
|
|
|
Local Codex inputs, calibration databases, runtime data, generated reports and
|
|
cross-project scratch are not release source. Never commit live `.env` files,
|
|
private keys, production backups or databases, customer or operator data,
|
|
unpublished imagery, credentials or private datasets. Public examples and tests
|
|
must use synthetic or explicitly redistributable material.
|
|
|
|
## Disclosure
|
|
|
|
Coordinate remediation and disclosure with the repository owner before publishing details that would materially increase exploitation risk.
|