14 lines
1.3 KiB
Markdown
14 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea credentials, repository write tokens, project-private source material, execution/session packs containing sensitive data, operator credentials, private infrastructure details or exploit-sensitive evidence in a public issue.
|
|
|
|
Include the affected release/commit, component, minimal reproduction conditions using synthetic project data where possible, expected and observed behaviour, impact, and whether the issue affects authentication, repository delivery, project isolation, approvals, MCP boundaries, archive/session-pack generation, webhook processing, audit history or deployment.
|
|
|
|
## Security and publication boundaries
|
|
|
|
ProjectBrain manages project context and governed repository delivery. Source material imported from private projects does not become public merely because ProjectBrain can index or package it. Session-pack exports must preserve their documented bounded scope and must not silently become repository backups.
|
|
|
|
Repository writes, merges and other external effects must remain attributable, validated and policy-controlled. Never commit live `.env` files, service credentials, private project archives or unredacted operational data.
|