itworx-knowledge-hub-Public/SECURITY.md

Security policy

Reporting a vulnerability

Do not open a public issue containing exploit details, credentials, private knowledge, deployment addresses or production evidence.

Until a monitored public security address is configured, use Gitea's private reporting channel or contact the repository owner privately. A public release must replace this temporary owner-only route with a monitored address routed to at least two maintainers.

Include the affected version or commit, the security boundary involved, reproduction steps using synthetic data, expected impact and any proposed mitigation. Never test against a deployment or data set you do not own or have explicit permission to assess.

Supported code

Security updates target the current default branch and the latest tagged release. Older releases may not receive backports.

Repository hygiene

Private agent memory, live environment configuration, production data and host-specific access details belong outside version control. Shared agent settings stay environment-neutral; workstation permissions belong in ignored local settings. Never commit live .env files, service-account credentials, production backups, personal data or private SSH material.

Knowledge boundary

Access to canonical product, operational and agent context does not make it suitable for public retrieval or publication. Preserve source classification, provenance, redaction, publication approval and least-privilege tool access. Never include private correspondence or legal, medical or employment material in a public source export.

Security invariants

• Private content remains private by default.
• Authorization is enforced in application services, not only in the UI.
• Service-account tokens are scoped, revocable and stored only as verification data.
• LeafWiki sources are read-only and imports are preflighted and reversible.
• Runbooks are documentation and are never executed by the platform.
• The application exposes no shell, arbitrary SQL or arbitrary filesystem capability.
• The production container remains non-root, capability-dropped and read-only except for documented data mounts.