mirror of
https://github.com/storytold/craft-ai-integrations.git
synced 2026-11-02 18:06:49 +00:00
Jeremy
4d8e733924
The comments and docs carried labels from our own planning (task u2, v3, l5, Phase 2e, t8) that mean nothing to a reader of a public repository, and one design note pointed at a folder that is no longer in the tree. CONTRIBUTING said main is protected, which is not set up yet. - Strip the task labels from module comments and test headers (comment text only; no code changes). Reword the ai-core crate comment to say the contract is provisional pending craft-libs review. - Rename docs/design/u2-declarative-adapter.md to declarative-adapter.md, point it at tools/mutation, and update the three references. - CONTRIBUTING: say changes arrive by pull request instead of claiming a protection that is not configured; make the build advice about local convenience, not a rule. - Add SECURITY.md (private reporting through GitHub), issue forms, a pull request template and .gitattributes (LF in the repository). Checked: cargo fmt --all --check, cargo check -p craft-ai-core -p craft-ai-egui, and mutation_check.py --dry on all 14 groups (every case still has exactly one target). CI runs the rest.
1.2 KiB
1.2 KiB
Security
This repository handles API keys, local model downloads, files fetched from the internet and the agreement a person gives before their data leaves the machine. Please report problems privately.
Reporting a vulnerability
Use GitHub's private reporting: open the Security tab of this repository and choose Report a vulnerability. Please do not open a public issue or pull request for it.
Include what you found, the crate and version or commit, and the smallest steps that reproduce it. We will acknowledge the report, tell you what we plan to do and credit you if you wish.
What counts
Examples of what we want to hear about:
- A key, token or other secret written to a file, a log, an error message or the shared store.
- Sending data to a provider without the person's agreement, or reusing an agreement beyond its app, connection, destination, kind of data or expiry.
- A downloaded archive or file that escapes its folder, overwrites something it should not, or runs.
- A request that follows a redirect or address it should refuse (for example to a private network).
- A TLS check that is weaker than documented.
Supported versions
The crates are pre-1.0 and nothing here is a final API. Fixes go to main.