Repository navigation
CLI safety guard, Dockerized E2E, env docs, gm_cli_ctx_t #166
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
bfaec2e
2c614d3
2fac424
b1b70b6
3ba29e0
7d05d81
48721df
f5fe955
d176f61
2de2639
79d10ba
285939a
94c91f1
f2a71c3
2841f62
83abaad
a560584
df4f3dc
39ddd32
c06eea7
90c8d29
0e124d6
4d28721
771f28b
613a73c
0b003f7
c7c3931
789a40f
1d234c5
2fed63e
66b46c4
77b2cd2
3c7c24f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -3,18 +3,19 @@ | |||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| ## 🛡️ Reporting a Vulnerability | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| If you discover a vulnerability in **Neuroglyph**, we strongly encourage you to report it privately and responsibly. | ||||||||||||||||||||||||||||||||||||||||||
| If you discover a vulnerability in __Neuroglyph__, we strongly encourage you to report it privately and responsibly. | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| Please email: | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| **🔒 james@flyingrobots.dev** | ||||||||||||||||||||||||||||||||||||||||||
| __🔒 <james@flyingrobots.dev>__ | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+6
to
11
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Strengthen private reporting channels (add GHSA, team alias, and encryption). Relying on a single personal mailbox is fragile and lacks an encrypted path. Recommend adding GitHub Security Advisories (private), a team alias, and PGP details; also tell reporters not to file public issues. -If you discover a vulnerability in __Neuroglyph__, we strongly encourage you to report it privately and responsibly.
-
-Please email:
-
-__🔒 <james@flyingrobots.dev>__
+If you discover a vulnerability in __Neuroglyph__, please report it privately and responsibly.
+
+Preferred private channels:
+- GitHub Security Advisories: use the “Report a vulnerability” link on this repository (private).
+- Email: security@neuroglyph.dev (PGP preferred; see Security.txt/PGP key below).
+- Fallback: james@flyingrobots.dev (personal).
+
+Please do not open public issues for security reports.Outside this file, consider adding:
📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||
| Include: | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| - A clear description of the issue | ||||||||||||||||||||||||||||||||||||||||||
| - Steps to reproduce (if applicable) | ||||||||||||||||||||||||||||||||||||||||||
| - Potential impact or scope | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+13
to
17
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Ask for actionable report details (versions, env, PoC, impact). Make triage faster and safer by requesting concrete artifacts and redaction guidance. -Include:
+Include:
- A clear description of the issue
- Steps to reproduce (if applicable)
- Potential impact or scope
+ - Affected versions/commit SHA and platform (OS, CPU, build flags, Docker image tag)
+ - Minimal PoC (non-destructive) and logs (redacted of secrets/PII)
+ - Workarounds/temporary mitigations if known
+ - Your CVSS v3.x vector/severity (optional)📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||
| We aim to respond to all reports within **72 hours**. | ||||||||||||||||||||||||||||||||||||||||||
| We aim to respond to all reports within __72 hours__. | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+18
to
19
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Define SLA, coordinated disclosure window, and safe‑harbor. Acknowledge/Triage/Remediate timelines plus legal safe‑harbor reduce ambiguity. -We aim to respond to all reports within __72 hours__.
+Service levels:
+- Acknowledge within __72 hours__
+- Triage and initial severity within __7 days__
+- Fix/mitigation or advisory within __90 days__ (or as mutually agreed)
+
+Coordinated disclosure: We kindly ask for a confidentiality period up to __90 days__ to prepare a fix and releases.
+
+Safe harbor: We will not pursue or support legal action for good‑faith, non‑destructive testing that respects privacy, data integrity, and applicable law, and that follows the guidance in this policy.📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||
| ## 🔐 Supported Versions | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
|
@@ -29,18 +30,19 @@ We currently support security fixes for the following versions: | |||||||||||||||||||||||||||||||||||||||||
| ## 🧪 Scope | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| This security policy applies to: | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| - The Neuroglyph CLI (`gitmind`) | ||||||||||||||||||||||||||||||||||||||||||
| - The optional daemon (`glyphd`) | ||||||||||||||||||||||||||||||||||||||||||
| - The Semlink protocol implementation | ||||||||||||||||||||||||||||||||||||||||||
| - Plugins officially maintained in this repository | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| It does **not** apply to third-party tools, forks, or downstream packages. | ||||||||||||||||||||||||||||||||||||||||||
| It does __not__ apply to third-party tools, forks, or downstream packages. | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+33
to
40
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Clarify scope and third‑party dependency handling. Tighten what’s covered and how upstream dependency issues are coordinated. -This security policy applies to:
+This security policy applies to first‑party code in this repository, including:
- The Neuroglyph CLI (`gitmind`)
- The optional daemon (`glyphd`)
- The Semlink protocol implementation
- Plugins officially maintained in this repository
-
-It does __not__ apply to third-party tools, forks, or downstream packages.
+ - Build scripts, Dockerfiles/images we publish, and CI/CD workflows that ship artifacts
+
+Out of scope:
+- Forks/downstream packages we do not control
+- Third‑party services and tools
+
+Third‑party dependencies: If a vulnerability is in an upstream dependency, please also report it to the upstream project. If it impacts Neuroglyph via our usage, we will coordinate and ship mitigations/workarounds where feasible.📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||
| ## 🧬 Philosophy | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| We believe semantic knowledge should be **safe**, **auditable**, and **resilient**. | ||||||||||||||||||||||||||||||||||||||||||
| We believe semantic knowledge should be __safe__, __auditable__, and __resilient__. | ||||||||||||||||||||||||||||||||||||||||||
| If Neuroglyph is to become cognitive infrastructure, it must be built on trust. | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+43
to
45
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧹 Nitpick (assertive) Nudge philosophy toward concrete security principles. Add explicit commitments (least privilege, defense‑in‑depth, secure‑by‑default). -We believe semantic knowledge should be __safe__, __auditable__, and __resilient__.
+We believe semantic knowledge should be __safe__, __auditable__, and __resilient__, guided by secure‑by‑default, least privilege, defense‑in‑depth, and privacy by design.📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||
| Thank you for helping us build something worthy of that trust. | ||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||
| — The Neuroglyph Maintainers 🧠 | ||||||||||||||||||||||||||||||||||||||||||
| — The Neuroglyph Maintainers 🧠 | ||||||||||||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧹 Nitpick (assertive)
Fix heading level increment (MD001) — use H2 under the H1
Current H3 after H1 violates heading-increment lint. Promote both section headers to H2.
Run markdownlint (or your docs CI) to confirm MD001 is cleared.
Also applies to: 13-14
🧰 Tools
🪛 markdownlint-cli2 (0.17.2)
6-6: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
🤖 Prompt for AI Agents