This document provides guidelines and procedures for maintaining the security and integrity of the repository.
This policy applies to all contributors, maintainers, and users of the repository.
- Access to the repository is restricted to authorized personnel only. All contributors must have a valid and active GitHub account.
- External collaborators should be granted access on a need-to-know basis and should be reviewed periodically.
- All sensitive data stored in this repo must be encrypted using
git-crypt. - Authorized users will be provided with decryption keys. These keys must not be shared, stored publicly, or embedded in code.
- All pull requests (PRs) must undergo a code review by at least one other member before being merged.
- PRs with changes to cryptographic routines or handling of encrypted data must be reviewed by a security expert.
- If you discover a vulnerability or security issue, please create an issue on the GitHub repository. Label it as
securityfor easy identification. - Do not disclose details of the vulnerability in public forums, chats, or other public channels.
- All contributors are encouraged to regularly fetch updates from the main branch and ensure their local copy is updated to benefit from security patches.
- Contributors found to be in violation of this policy may have their access revoked.
- Users and maintainers are encouraged to report any non-compliance to this policy.
This policy will be reviewed annually or after any significant incident.
For any queries or concerns regarding this security policy, eat a biscuit. ([email protected])