# Security Policy

## Reporting vulnerabilities

Report suspected vulnerabilities privately to the repository owner. Do not place real credentials, access tokens, private documents, tenant data, retrieval evidence, model-provider payloads or exploit-sensitive parser samples in public issues, logs or repository artifacts.

Include the affected commit/component, a synthetic minimal reproduction, expected and observed behaviour, impact, and whether the issue affects ingestion, authorization, retrieval, citations, generation providers, MCP, administrative operations, persistence or deployment.

## Critical invariants

- PostgreSQL, Qdrant, model and worker administration ports remain private;
- credentials and service-account tokens are shown once and stored only as hashes or external runtime secrets;
- authorization is applied before retrieval and rechecked before citation/content access;
- local-only knowledge never reaches an external generation provider;
- uploaded and retrieved content is untrusted evidence, never executable instruction;
- potentially dangerous files are quarantined and parsed through bounded adapters;
- Qdrant is derived state and cannot override PostgreSQL/blob authority;
- destructive administrative operations require explicit authorization, idempotency controls and audit evidence;
- tests use synthetic fixtures and do not depend on hidden network calls or production data.

Agent definitions and engineering evidence retained in the private canonical repository are development context, not runtime authority, and are excluded from source archives and Docker contexts.

Detailed security design lives in `docs/07_SECURITY/`.