Ferrell Synthetic Intelligence commited on
Commit ·
586338b
1
Parent(s): 0029ad0
Prepare release candidate hardening
Browse files- SECURITY.md +4 -0
SECURITY.md
CHANGED
|
@@ -16,3 +16,7 @@ Never include access tokens, private keys, credentials, private source, unredact
|
|
| 16 |
- Treat model output, plugins, dependencies, and imported artifacts as untrusted.
|
| 17 |
- Require diff review and user approval before writes or publication.
|
| 18 |
- Treat capsules as metadata by default; source/evidence export must be explicit and encrypted.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 16 |
- Treat model output, plugins, dependencies, and imported artifacts as untrusted.
|
| 17 |
- Require diff review and user approval before writes or publication.
|
| 18 |
- Treat capsules as metadata by default; source/evidence export must be explicit and encrypted.
|
| 19 |
+
|
| 20 |
+
## Known Upstream Advisory
|
| 21 |
+
|
| 22 |
+
The desktop GTK dependency currently pins `glib` below the patched `0.20.0` release. Dependabot's attempted upgrade is incompatible with GTK 0.18 and fails CI. The issue is tracked as an upstream dependency constraint; AIDE does not suppress the security alert or claim the dependency is fixed.
|