Skip to content

Security: barchenkoN/impact-ledger

Security

SECURITY.md

Security policy

Prototype status

ImpactLedger is a portfolio MVP and is not approved for production, real applicant documents, personal data, investment decisions or payment execution.

Do not upload real identity, financial, health, safeguarding or beneficiary information to a public deployment of this repository.

Reporting a vulnerability

Please do not open a public issue for a vulnerability that could expose data or enable unauthorized actions. Contact the repository owner privately with:

  • affected version and component;
  • reproduction steps or a minimal proof of concept;
  • expected and actual behavior;
  • potential data or authorization impact;
  • suggested remediation, if available.

Do not access data that is not yours, run destructive tests against shared systems or retain sensitive material while investigating.

Security boundaries in v0.1

  • No authentication, tenant isolation or production persistence is implemented.
  • Demo data is fictional or synthetic.
  • No external LLM call is made.
  • No funds are held or transferred.
  • Milestone output is advisory and always requires human approval.
  • KYB, sanctions, AML, PSP and ECSP capabilities are integration boundaries only.

See GDPR and regulatory boundaries, AI system card and architecture before adapting the code.

There aren't any published security advisories