Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported code
+
+Security fixes target the current `main` release line. Historical design-pack, work-packet and experiment branches are retained for traceability and are not separate supported release channels.
+
+## Reporting vulnerabilities
+
+Report suspected vulnerabilities privately to the repository owner. Do not publish access tokens, authorization headers, private infrastructure details, production configuration, audit data containing identifiers, signing material or exploit-sensitive evidence in a public issue.
+
+A useful report includes the affected commit/component, minimal reproduction conditions using synthetic data where possible, expected and observed behaviour, impact, and whether the issue affects authentication, authorization, project/environment isolation, connector boundaries, secret redaction, Docker broker isolation, MCP framing/session handling or deployment controls.
+
+## Control-plane boundary
+
+The canonical MCP Hub is a privileged operational control plane. Preserve least-privilege connectors, explicit read/write separation, repository and workspace allowlists, optimistic locking, validation gates, attributable changes and fail-closed behaviour. Public examples or SDK material must never include operational credentials, private topology or production connector configuration.
+
+## Security invariants
+
+The normative security requirements in `docs/02-security/SECURITY_INVARIANTS.md` are release requirements. Contributions must preserve deny-by-default authorization, bounded target-specific connectors, secret non-disclosure, auditability, and the prohibition on unrestricted shell/filesystem/SQL/Docker capabilities through MCP.
+
+Never commit live `.env` files, tokens, private keys, production secrets or unredacted sensitive runtime evidence.
+
+## Disclosure
+
+Coordinate remediation and disclosure with the repository owner before publishing technical details that would materially increase exploitation risk.