24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Report suspected vulnerabilities privately to the repository owner. Do not place real credentials, access tokens, private documents, tenant data, retrieval evidence, model-provider payloads or exploit-sensitive parser samples in public issues, logs or repository artifacts.
|
|
|
|
Include the affected commit/component, a synthetic minimal reproduction, expected and observed behaviour, impact, and whether the issue affects ingestion, authorization, retrieval, citations, generation providers, MCP, administrative operations, persistence or deployment.
|
|
|
|
## Critical invariants
|
|
|
|
- PostgreSQL, Qdrant, model and worker administration ports remain private;
|
|
- credentials and service-account tokens are shown once and stored only as hashes or external runtime secrets;
|
|
- authorization is applied before retrieval and rechecked before citation/content access;
|
|
- local-only knowledge never reaches an external generation provider;
|
|
- uploaded and retrieved content is untrusted evidence, never executable instruction;
|
|
- potentially dangerous files are quarantined and parsed through bounded adapters;
|
|
- Qdrant is derived state and cannot override PostgreSQL/blob authority;
|
|
- destructive administrative operations require explicit authorization, idempotency controls and audit evidence;
|
|
- tests use synthetic fixtures and do not depend on hidden network calls or production data.
|
|
|
|
Agent definitions and engineering evidence retained in the private canonical repository are development context, not runtime authority, and are excluded from source archives and Docker contexts.
|
|
|
|
Detailed security design lives in `docs/07_SECURITY/`.
|