mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-23 20:26:10 +00:00
Oliver Kieselbach
ce9efb6f6c
- Root LICENSE is now the verbatim AGPL-3.0 text so GitHub detects the license instead of showing "Other"; the split model (MIT for Agent + Shared) is explained in the README and each component keeps its own license file. - README: MCP server in the component list, an "AI Integration (MCP)" section with example prompts and the server URL, and a neutral Feedback section. - SECURITY.md routes reports to private GitHub Security Advisories. - CONTRIBUTING.md is a feedback routing page (issues, discussions, security, Report Session button), CODE_OF_CONDUCT.md is short and neutral. - Issue forms for bug reports and feature requests; blank issues disabled. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report security issues **privately** through
|
|
[GitHub Security Advisories](https://github.com/okieselbach/AutopilotMonitor/security/advisories/new).
|
|
Private vulnerability reporting is enabled, so a report reaches the maintainers without ever being public.
|
|
|
|
Please do not open a public issue, post on social media, or send email for security findings.
|
|
|
|
## What to expect
|
|
|
|
- An acknowledgement and an initial severity assessment.
|
|
- A fix or a mitigation plan, with a shared view of timing before anything is disclosed.
|
|
- Credit in the advisory if you want it, and none if you prefer to stay anonymous.
|
|
|
|
Reports are read by the maintainers directly. There is no guaranteed response time and no bug bounty.
|
|
|
|
## Scope and rules of engagement
|
|
|
|
Security research against the hosted service is welcome and is not a violation of the
|
|
[Terms of Use](https://www.autopilotmonitor.com/terms). While testing, please:
|
|
|
|
- do not access data of tenants you do not own,
|
|
- do not degrade the service for others,
|
|
- do not run automated scanners against production.
|
|
|
|
## Supported versions
|
|
|
|
The hosted service always runs the current `main`. For the on-device agent, only the
|
|
[latest release](https://github.com/okieselbach/AutopilotMonitor/releases/latest) receives fixes.
|
|
|
|
## More
|
|
|
|
The [Security FAQ](https://docs.autopilotmonitor.com/trust-and-security/security-faq) and
|
|
[Data Flows](https://docs.autopilotmonitor.com/trust-and-security/data-flows) pages describe the security model,
|
|
data handling, and isolation in detail.
|