Skip to content

Security: sysWisdom/AIQualityManifesto

Security

SECURITY.md

Security & Governance Policy

This document reflects the governance principles of The AI Quality Manifesto applied to this repository itself. We practice what we publish.


Scope

This repository contains the AI Quality Manifesto — a public document. It does not contain executable code, infrastructure configuration, or secrets. However, governance standards still apply to how this repository is maintained and how contributions are reviewed.


Reporting Concerns

If you discover content in this repository that:

  • Makes false claims or fabricates citations (AI hallucination risk)
  • Has been tampered with in a way that misrepresents the manifesto's intent
  • Contains a dependency, link, or reference that poses a security or integrity risk

Please report it by opening a private security advisory via GitHub's Security Advisories feature, or email directly:

security@syswisdom.ai

Do not open a public issue for integrity concerns. Allow maintainers to review and respond before public disclosure.


Repository Governance Standards

In alignment with the manifesto's principle that governance must be embedded in workflows, not added after failure, this repository follows these practices:

Practice Implementation
Human review required All pull requests require maintainer approval before merge
No force pushes to main Branch protection rules enforced — see setup instructions below
Signed commits encouraged Contributors are encouraged to sign commits with GPG
Dependency review Any external links or references are reviewed for credibility and longevity
Audit trail All changes to core manifesto content are tracked via git history

Enabling Branch Protection on main

To enforce the human-review requirement on GitHub:

  1. Go to your repository → SettingsBranches
  2. Under Branch protection rules, click Add rule
  3. Set Branch name pattern to main
  4. Enable the following:
    • Require a pull request before merging
      • ✅ Require at least 1 approval
      • ✅ Dismiss stale pull request approvals when new commits are pushed
    • Require status checks to pass before merging (if CI is added later)
    • Do not allow bypassing the above settings (applies to admins too)
    • Restrict force pushes
    • Restrict deletions
  5. Click Create

This ensures no change to the manifesto reaches main without accountable human review — consistent with Principle 1: Human Judgment Is the Final Authority.


Accountability

AI cannot own responsibility. Humans still do.

The maintainers of this repository are accountable for its integrity. If the repository is compromised or its content misrepresented, that is a human governance failure — and will be treated as such.

Maintainer: Aaron McCormack — Founder & CTO, SysWisdom.ai


This policy is reviewed whenever a new version of the manifesto is published.

There aren't any published security advisories