14 lines
1.0 KiB
Markdown
14 lines
1.0 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Report suspected vulnerabilities privately to the repository owner. Do not publish credentials, private infrastructure, precise sensitive locations, proprietary imagery, private datasets, model artifacts, database snapshots or exploit-sensitive evidence in a public issue.
|
|
|
|
Include the affected commit/component, minimal reproduction conditions using synthetic data where possible, expected and observed behaviour, impact, and whether the issue affects ingestion, geospatial processing, model inference, exports, authorization, deployment or data retention.
|
|
|
|
## Data boundary
|
|
|
|
Geospatial inputs and derived outputs can reveal people, assets and sensitive locations. Treat screenshots, contact sheets, coordinates, source archives, SQLite/WAL state, model output and exports as potentially sensitive. These belong in external controlled storage, not the source repository.
|
|
|
|
Never commit live `.env` files, credentials, private keys, production databases, unpublished imagery, customer data or local AI-workspace artifacts.
|