1fe689a7bf
* docs: add mdBook and security documentation foundation * docs: point book links at storytold/photocraft; scope the credits entry The book's repository/edit URLs and source links pointed at the contributor's fork. The credits entry now describes what this PR contributed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Brandon Thomas <echelon@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1.0 KiB
Vulnerability reporting
The repository-level SECURITY.md is the authoritative reporting policy.
Do not publish exploit details, weaponized files, secrets, or sensitive crash data before maintainers have had a reasonable opportunity to review and coordinate a fix. The repository currently documents no dedicated private security email or private reporting address.
A useful report identifies affected versions or commits, platform/build configuration, impact, exact reproduction steps, expected versus actual behavior, and relevant logs or backtraces. For a malicious test file, first provide a minimal description, hash, format, and safe transfer requirements; do not attach it publicly when it could harm users or contains non-redistributable data.
Security scope includes parsers, import/export, .pcraft, profiles/LUTs/patterns, command validation, automation, MCP, the control server, path handling, GPU resource validation, dependencies, CI, packaging, updates, and artifact verification.