mirror of
https://github.com/merlinhu1/truthmark.git
synced 2026-08-25 07:53:25 +02:00
2dc0da40ff
* Split Truthmark product and engineering truth lanes * chore: align truthmark docs and runtime with lane updates * chore: bump package version to 2.2.0 * chore: refresh truthmark surfaces for 2.2.0 and document release * chore: migrate legacy truth docs to engineering legacy path * chore: remove legacy docs/truth legacy docs from repository * chore: trim document command prompts to adapter stubs * chore: customize truth root README guidance per lane * chore: make doc reviewer guidance lane-specific and helper-rendered * fix: remove duplicate check lane-classification render in evidence gate * fix: make realize doc example lane-agnostic to product and engineering * feat: separate product and engineering truth lanes * test: restore workflow surface coverage * Fix workflow lane prompt boundaries * test: guard read-only generated surface wording * Fix manual Realize lane guidance * fix: harden route relationship diagnostics Validate reciprocal product and engineering route links, gate missing product-link review diagnostics on product evidence, and reject duplicate route entries with divergent relationship metadata. * fix: merge duplicate route relationships Allow repeated route entries for the same truth document, kind, and lane to contribute additive relationship metadata. Keep hard validation errors for kind and lane conflicts and emit merged relationships in RouteMap output. * fix: make route relationships local Treat realized_by and realizes metadata as route-local navigation edges. Validate target existence and lane compatibility without requiring reciprocal declarations, and document the chosen semantics. --------- Co-authored-by: MerlinH <merlinh221@gmail.com>
28 lines
1.3 KiB
Markdown
28 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are handled on the current maintained release line of Truthmark. If you are using an older version, upgrade to the latest published version before reporting unless the issue only exists in the current release.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please do not post exploitable vulnerability details in a public issue.
|
|
|
|
Preferred reporting path:
|
|
|
|
1. Use GitHub's private vulnerability reporting or security advisory flow for this repository when available.
|
|
2. If private reporting is unavailable, open a GitHub issue with a minimal description and no exploit details, then coordinate details with the maintainer through the channel they provide.
|
|
|
|
Useful report details:
|
|
|
|
- affected Truthmark version or commit
|
|
- operating system and Node.js version
|
|
- whether the issue affects the CLI, generated workflow surfaces, validation commands, or repository file handling
|
|
- impact and reproduction steps, with secrets and private repository content removed
|
|
|
|
## Scope
|
|
|
|
Security-sensitive areas include command execution boundaries, generated workflow guidance, path handling, repository write boundaries, package publishing, and handling of untrusted repository Markdown/configuration.
|
|
|
|
Truthmark is local-first and Git-native. It should not require a daemon, database, hosted service, or hidden memory layer for normal operation.
|