Skip to main content

Research policy

Security policy

How to report a vulnerability privately, what this project supports, and what its machine checks do and do not prove. The canonical text is SECURITY.md in the source repository; this page mirrors it.

Private reporting

Report suspected vulnerabilities, exposed data, or leaked credentials privately to [email protected]. Do not open a public issue with exploit details, personal data, private transcripts, or secrets. The same address is published in /.well-known/security.txt.

Include the affected component and version or commit, impact, safe reproduction steps, and whether data may already be exposed. A minimal report is welcome even when a complete proof of concept would be unsafe.

The intended response target is acknowledgement within five business days. Disclosure timing, remediation, credit, and anonymity will be coordinated with the reporter. This is a best-effort research project response target, not a bounty or service-level agreement.

Supported release surface

Security support applies to the current public website artifact, the current psychopathia-mcp package, and the current public MCP deployment. Historical research scripts, quarantined analyses, unpublished worktrees, third-party model hosts, provider APIs, and modified deployments are outside the maintained release surface. Upstream issues that affect this project are still relevant and should be reported.

Security properties

  1. The website is built from the explicit allowlist in release/site-files.yaml. Repository-root publication is forbidden.
  2. Clinic cloud routing fails closed, uses separate provider key slots, bounds restored structured messages, and self-hosts its browser-executable model libraries. User-selected inference providers and model hosts remain external trust boundaries.
  3. The MCP package is read-only. Stdio performs no network calls unless the optional embedding model is first acquired. Public HTTP adds bounded inputs, body, concurrency, timeout, host, origin, and response controls. Reverse-proxy rate limits, capacity, logs, and incident response remain deployment responsibilities.
  4. Canonical data, package data, embeddings, and public derivatives are bound to the manifest corpus digest.
  5. Secrets must remain outside the repository. A candidate cannot advance with credible secret, personal-data, or forbidden-artifact findings.

Implementation controls do not prove the live host, proxy, DNS, provider, or registry state. Those are checked separately against the exact candidate during release review.

Safe research

Do not test production, third-party systems, or user data without authorisation. Avoid destructive, high-volume, privacy-invasive, or welfare-risking probes. Follow the responsible-use boundaries for diagnostic and Becoming Mind welfare boundaries.

Working if: sensitive reports reach a private channel, exact-candidate security gates fail closed, and no source or machine pass is treated as proof of live edge configuration.