OGDE

Security policy

OGDE is a prototype and is not a production incident-response authority.

• Report security issues privately through GitHub private vulnerability reporting once enabled on the repository. Do not publish exploit details against real targets.
• Do not place operational signing keys, production inventories, IP addresses, credentials or personal data in GitHub issues.
• Advisory signing keys are owned and operated by each feed publisher. Distribute trust anchors through an authenticated, independent channel; do not retrieve a key from the same untrusted URL as its advisory.
• The current ledger is single-writer and must have its hash head anchored externally for meaningful tamper evidence.
• No remote execution, production modification or automated remediation is included.

Supported prototype: v0.2.2 receives best-effort updates. v0.3 work in this tree is not a production control and has no SLA.

ogde inventory and ogde report are local. They do not upload an inventory. Collectors are not allowed to read wp-config.php, environment files, private keys or database contents; the tests fail if they do.

Federated publisher security (v0.2)

Verify trust-anchor fingerprints independently before pinning. Do not accept signing keys embedded in untrusted advisories, email links or AI responses as authoritative. Protect .ogde-local/, revision-state files, private reports and key material. assess only recommends human-reviewed actions and must not be connected directly to privileged production execution. See docs/FEDERATION_V2.md for trust and anti-rollback limitations.

This site is open source. Improve this page.