Files
geointel/SECURITY.md
T

14 lines
1.0 KiB
Markdown

# Security Policy
## Reporting vulnerabilities
Report suspected vulnerabilities privately to the repository owner. Do not publish credentials, private infrastructure, precise sensitive locations, proprietary imagery, private datasets, model artifacts, database snapshots or exploit-sensitive evidence in a public issue.
Include the affected commit/component, minimal reproduction conditions using synthetic data where possible, expected and observed behaviour, impact, and whether the issue affects ingestion, geospatial processing, model inference, exports, authorization, deployment or data retention.
## Data boundary
Geospatial inputs and derived outputs can reveal people, assets and sensitive locations. Treat screenshots, contact sheets, coordinates, source archives, SQLite/WAL state, model output and exports as potentially sensitive. These belong in external controlled storage, not the source repository.
Never commit live `.env` files, credentials, private keys, production databases, unpublished imagery, customer data or local AI-workspace artifacts.