Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

SECURITY.md

@@ -0,0 +1,45 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Do not open a public issue containing exploit details, credentials, private knowledge,
+deployment addresses or production evidence.
+
+Until a monitored public security address is configured, use Gitea's private reporting
+channel or contact the repository owner privately. A public release must replace this
+temporary owner-only route with a monitored address routed to at least two maintainers.
+
+Include the affected version or commit, the security boundary involved, reproduction
+steps using synthetic data, expected impact and any proposed mitigation. Never test
+against a deployment or data set you do not own or have explicit permission to assess.
+
+## Supported code
+
+Security updates target the current default branch and the latest tagged release. Older
+releases may not receive backports.
+
+## Repository hygiene
+
+Private agent memory, live environment configuration, production data and host-specific
+access details belong outside version control. Shared agent settings stay
+environment-neutral; workstation permissions belong in ignored local settings.
+Never commit live `.env` files, service-account credentials, production backups,
+personal data or private SSH material.
+
+## Knowledge boundary
+
+Access to canonical product, operational and agent context does not make it suitable
+for public retrieval or publication. Preserve source classification, provenance,
+redaction, publication approval and least-privilege tool access. Never include private
+correspondence or legal, medical or employment material in a public source export.
+
+## Security invariants
+
+- Private content remains private by default.
+- Authorization is enforced in application services, not only in the UI.
+- Service-account tokens are scoped, revocable and stored only as verification data.
+- LeafWiki sources are read-only and imports are preflighted and reversible.
+- Runbooks are documentation and are never executed by the platform.
+- The application exposes no shell, arbitrary SQL or arbitrary filesystem capability.
+- The production container remains non-root, capability-dropped and read-only except
+  for documented data mounts.