geointel/SECURITY.md

Security Policy

Reporting vulnerabilities

Report suspected vulnerabilities privately to the repository owner. Do not publish credentials, private infrastructure, precise sensitive locations, proprietary imagery, private datasets, model artifacts, database snapshots or exploit-sensitive evidence in a public issue.

Include the affected commit/component, minimal reproduction conditions using synthetic data where possible, expected and observed behaviour, impact, and whether the issue affects ingestion, geospatial processing, model inference, exports, authorization, deployment or data retention.

Data boundary

Geospatial inputs and derived outputs can reveal people, assets and sensitive locations. Treat screenshots, contact sheets, coordinates, source archives, SQLite/WAL state, model output and exports as potentially sensitive. These belong in external controlled storage, not the source repository.

Never commit live .env files, credentials, private keys, production databases, unpublished imagery, customer data or local AI-workspace artifacts.