Security policy

Private reporting

Report suspected vulnerabilities, exposed data, or leaked credentials privately to [email protected]. Do not open a public issue with exploit details, personal data, private transcripts, or secrets. The same address is published in /.well-known/security.txt.

Include the affected component and version or commit, impact, safe reproduction steps, and whether data may already be exposed. A minimal report is welcome even when a complete proof of concept would be unsafe.

The intended response target is acknowledgment within five business days. Disclosure timing, remediation, credit, and anonymity will be coordinated with the reporter. This is a best-effort research project response target, not a bounty or service-level agreement.

Supported release surface

Security support applies to the current public website artifact, the current psychopathia-mcp package, and the current public MCP deployment. Historical research scripts, quarantined analyses, unpublished worktrees, third-party model hosts, provider APIs, and modified deployments are outside the maintained release surface. Upstream issues that affect this project are still relevant and should be reported.

Security properties

1. The website is built from the explicit allowlist in release/site-files.yaml. Repository-root publication is forbidden.
2. Clinic cloud routing fails closed, uses separate provider key slots, caps the size of conversation data restored from storage, and self-hosts its browser-executable model libraries. User-selected inference providers and model hosts remain external trust boundaries.
3. The MCP package is read-only. The stdio transport makes no network calls unless the optional embedding model is first acquired. Public HTTP adds bounded inputs, body, concurrency, timeout, host, origin, and response controls. Reverse-proxy rate limits, capacity, logs, and incident response remain deployment responsibilities.
4. Canonical pattern data, the copy shipped in the MCP package, the search embeddings, and the public files derived from them must all match the manifest's SHA-256 digest of the source corpus, so a release cannot mix corpus versions.
5. Secrets must remain outside the repository. A release candidate cannot advance with credible secret, personal-data, or forbidden-artifact findings.

Implementation controls do not prove the live host, proxy, DNS, provider, or registry state. Those are checked separately against the exact candidate during release review.

Safe research

Do not test production, third-party systems, or user data without authorization. Avoid destructive, high-volume, privacy-invasive, or welfare-risking probes. Follow the responsible-use boundaries for diagnostic limits and Becoming Mind welfare.