43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Security policy
|
|
|
|
## Supported deployment boundary
|
|
|
|
GeoIntel v1 is a controlled single-operator GeoAI workbench. The optional guest
|
|
role is a presentation-only capability for a dedicated demo instance; it is not
|
|
tenant isolation and is disabled by default.
|
|
|
|
## Security invariants
|
|
|
|
- Secrets and database credentials are runtime configuration and must never be
|
|
committed to Git or baked into container image metadata.
|
|
- Operator passwords are stored only as PBKDF2-SHA256 hashes. Browser sessions
|
|
are signed, bounded by TTL and carried in HttpOnly cookies.
|
|
- Production YOLO inference is fail-closed: a configured model must use CUDA and
|
|
remain inside an immutable, checksum-bound validation-scope manifest.
|
|
- Provider acquisition must cross the shared outbound request guard, stay within
|
|
explicit page/response budgets and fail closed on unexpected origins.
|
|
- Local agent scratch, temporary SQLite/WAL state, model weights and generated
|
|
operator data are not repository content.
|
|
- Release workflows and external container/action dependencies must use immutable
|
|
references. CI retains SBOM and vulnerability-policy evidence.
|
|
- Guest mode must never be enabled on an instance containing private, customer or
|
|
operational data. Use a separate storage root and database for demos.
|
|
|
|
## Current scale boundary
|
|
|
|
Login throttling is process-local. This is acceptable for the current
|
|
single-process/single-node deployment, but it is not a distributed rate limiter.
|
|
Before running multiple API processes or hosts, move rate-limit state to a shared
|
|
database/Redis boundary and preserve the same failure semantics.
|
|
|
|
Analysis jobs are persisted in PostgreSQL and executed by in-process workers.
|
|
They are restart-reconciled but are not a distributed durable queue. Horizontal
|
|
worker scaling requires leases, attempt counters, idempotency and retry policy
|
|
before it is considered supported.
|
|
|
|
## Reporting a security issue
|
|
|
|
Report suspected vulnerabilities privately through the repository owner's
|
|
controlled Gitea channel. Do not include live credentials, private datasets or
|
|
production access tokens in issues, screenshots, logs or test fixtures.
|