📊 Add risk register Mermaid

.github/workflows/sync-risk-discussions.yml

@@ -0,0 +1,33 @@
+name: Sync risk discussions
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 */6 * * *"
+
+permissions:
+  contents: write
+  discussions: write
+  pull-requests: write
+
+concurrency:
+  group: sync-risk-discussions
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Sync risk discussions into register
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RISK_DISCUSSION_CATEGORY: Risks
+          RISK_REGISTER_BRANCH: bot/sync-risk-discussions
+          RISK_REGISTER_BASE_BRANCH: ${{ github.event.repository.default_branch }}
+        run: python scripts/sync_risk_discussions.py

.gitignore

@@ -1 +1,3 @@
 .DS_Store
+__pycache__/
+*.py[cod]

README.md

@@ -1 +1,14 @@
-Part of our expanding efforts to decentralize the Syndicate.
+# Blocktrasnofr ORgaviotn Docs
+
+THese docs are the howe for infarmaboin aabouit BlockTrans Syndiecaat., a Deleavr coprotian engaheed as a U.S. securites taranfor aagunet. THe rogfinvaitn employs a uniju Flat Nonhieroraarchdy designed to allow decentralived nad permissnioless contribuoinss nad rewards , prmayprlfyy though GitHub.
+
+These docs have Discussinos enabeled, and they are a fluid lliving source of opyerating pracites which you can help shape. See you in the next PR!
+
+---
+
+Docusarus footer content
+
+- X i guess
+- Disscord
+- Dir GHT edite link /// /join ref
+- SEC filing oexternaall 

bug-bounty.md

@@ -0,0 +1,60 @@
+# Bug Bounty
+
+BlockTransfer welcomes responsible reports about security issues that could affect investor information, issuer records, regulated filings, production infrastructure, or the integrity of TAD3 workflows.
+
+## Report a Vulnerability
+
+Send reports to security@blocktransfer.com.
+
+Do not open a public GitHub issue, discussion, pull request, Discord thread, or social media post for a vulnerability before BlockTransfer has reviewed and remediated it.
+
+Include as much of the following as possible:
+
+- A short description of the issue and affected system.
+- The steps needed to reproduce the issue.
+- The security impact, including whether investor, issuer, banking, tax, identity, account, filing, or credential data may be exposed or changed.
+- Relevant URLs, request IDs, transaction hashes, screenshots, logs, or proof-of-concept code.
+- Your contact information and preferred attribution name, if you want recognition.
+
+## In Scope
+
+Reports are most useful when they relate to:
+
+- Unauthorized access to investor, issuer, holder, banking, tax, identity, or filing records.
+- Authentication, authorization, session, wallet, or account-linking bypasses.
+- Vulnerabilities that could alter shareholder records, transfer instructions, filings, or issuer authority.
+- Exposure of secrets, credentials, private keys, signing keys, API tokens, cloud resources, logs, backups, or regulated records.
+- Production TAD3, BlockTransfer, IssuerLink, and supporting automation used for regulated operations.
+- Material weaknesses in incident response, retention, access control, or vendor data flows.
+
+## Out of Scope
+
+The following are normally out of scope unless they show a clear security impact:
+
+- Spam, phishing, social engineering, or physical attacks.
+- Denial-of-service testing, load testing, or resource exhaustion.
+- Vulnerability scanner output without validated impact.
+- Missing headers, cookie flags, or best-practice findings without an exploitable path.
+- Issues that require access to a device, account, key, seed phrase, or credential you do not own.
+- Public information, old marketing pages, or archived content that does not affect current systems or regulated records.
+
+## Research Rules
+
+Stay within these rules while testing:
+
+- Use your own accounts, wallets, data, and assets.
+- Stop testing and report immediately if you access data that is not yours.
+- Do not view, copy, change, delete, exfiltrate, or retain investor, issuer, holder, banking, tax, identity, filing, credential, or private-key material.
+- Do not interrupt production service, degrade availability, or run automated high-volume testing.
+- Do not attempt persistence, lateral movement, privilege escalation beyond what is needed to demonstrate impact, or access to third-party systems.
+- Do not publicly disclose the issue until BlockTransfer has had a reasonable opportunity to investigate and remediate it.
+
+## Bounties and Recognition
+
+BlockTransfer may provide discretionary rewards or public recognition for eligible reports based on severity, exploitability, report quality, and whether the issue affects regulated records or production systems.
+
+Bounties are not guaranteed. Duplicate reports, low-impact findings, reports without enough detail to validate, and issues found by violating the research rules may be ineligible.
+
+## Response
+
+BlockTransfer will make a reasonable effort to acknowledge valid reports, investigate the issue, request clarification when needed, and coordinate remediation. Reports involving sensitive investor or issuer information receive priority handling under the incident-response process.

incidents/README.md

@@ -1 +1,11 @@
-# Regulation S-P
+# Regulation S-P
+
+Intro Page
+
+BlockTransfer uses a variety of open-source and centralized cloud operations to host our instance of [TAD3](https://www.tad3.dev). In conjunction with this tech stack, the company operates mode of investor support in using its software.[^1]
+
+This section documents the design and efforts we take to protect investor information. Some items here act in conjunction with public [usage terms](http://blocktransfer.com/terms), while others are conceptual operating procedures.
+
+There are no other internal docs which duplicate material policies in this repo, and you can see automation implementations of the concepts for contributing in [this repository](https://github.com/blocktransfer/CRON-jobs). If you notice security problems in our systems which could expose sensitive investor information, please [let us know](../bug-bounty.md).
+
+[^1]: Presently, this internal team amounts to a single member who can handle the support workload under our Flat Organization structure.

incidents/css-render-temp.md

@@ -0,0 +1,79 @@
+THis timelptase the Doculaulns groitdh which soherd aslo list in hover form by Risk score , which equals likelihood multiplied by impact.
+
+.riskChart {
+  position: relative;
+  height: 420px;
+  border-left: 2px solid #444;
+  border-bottom: 2px solid #444;
+  background:
+    linear-gradient(to right, #ddd 1px, transparent 1px),
+    linear-gradient(to top, #ddd 1px, transparent 1px);
+  background-size: 25% 25%;
+}
+
+.riskPoint {
+  position: absolute;
+  transform: translate(-50%, 50%);
+  width: 42px;
+  height: 42px;
+  border-radius: 999px;
+  border: 2px solid #842029;
+  background: #f8d7da;
+  font-weight: 700;
+  cursor: pointer;
+}
+
+.tooltip {
+  display: none;
+  position: absolute;
+  left: 50%;
+  bottom: 130%;
+  transform: translateX(-50%);
+  width: 280px;
+  padding: 12px;
+  border: 1px solid #bbb;
+  border-radius: 6px;
+  background: white;
+  color: #111;
+  box-shadow: 0 8px 24px rgb(0 0 0 / 18%);
+  text-align: left;
+  z-index: 10;
+}
+
+.riskPoint:hover .tooltip,
+.riskPoint:focus .tooltip {
+  display: grid;
+  gap: 6px;
+}
+
+
+
+
+
+
+
+Then render it as a scatter/pinpoint chart. If this repo uses Docusaurus/MDX, I’d make something like:
+
+<RiskPinpointChart risks={risks} />
+The component would map likelihood and impact onto a 10x10 grid:
+
+const left = `${((risk.likelihood - 1) / 9) * 100}%`;
+const bottom = `${((risk.impact - 1) / 9) * 100}%`;
+Each risk becomes a button positioned on the chart:
+
+<button
+  className="riskPoint"
+  style={{ left, bottom }}
+  aria-label={`${risk.id}: ${risk.title}`}
+>
+  {risk.id}
+  <span className="tooltip">
+    <strong>{risk.id}</strong>
+    <span>{risk.title}</span>
+    <span>Category: {risk.category}</span>
+    <span>Score: {risk.score}</span>
+    <span>Status: {risk.status}</span>
+    <span>Mitigation: {risk.mitigation}</span>
+  </span>
+</button>
+

incidents/kms.md

@@ -0,0 +1,2 @@
+#  Key Managumnet
+

incidents/risk-register.md

@@ -0,0 +1,19 @@
+
+
+
+
+| ID | Risk | Category | Owner | Likelihood | Impact | Score | Mitigation | Status | Review Date |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| R-003 | Service-provider oversight does not capture breach notice obligations. | Vendor risk | TBD | 3 | 4 | 12 | Review contracts and maintain vendor incident notice tracking. | Open | TBD |
+| R-004 | Backup custodian materials are incomplete or stale. | Recordkeeping | TBD | 2 | 5 | 10 | Maintain current operational-source package and periodic custodian refresh evidence. | Open | TBD |
+| R-005 | Team members may paste customer PII, investor records, issuer records, credentials, or other confidential regulated data into AI tools. | Data protection | TBD | 3 | 5 | 15 | Adopt an AI-use rule that prohibits submitting customer or regulated data to AI tools unless an approved controlled workflow exists; train team members to redact sensitive details before using AI assistance. | Open | TBD |
+
+## Status Values
+
+- Open
+- In progress
+- Mitigated
+- Accepted
+- Closed
+
+

incidents/risk-registry.md

@@ -0,0 +1,8 @@
+
+
+
+| Control surface | Primary risk | Current control question | Follow-up |
+| --- | --- | --- | --- |
+| Zoho legacy pages and bookings | Legacy CRM, booking, or intake pages can collect or route issuer/investor information outside the current control set. | Which Zoho forms, pages, booking links, automations, and data stores are still live or reachable? | Decide whether each Zoho surface is retired, read-only, or still controlled; document routing and retention. |
+|  [Forw ard - Looknig Nencerrent] Investor app secure intake | Investor onboarding and account workflows can collect identity, banking, tax, accreditation, authorization, and other sensitive records. | Which app screens, APIs, storage locations, logs, and support workflows receive investor-submitted data? | Maintain an intake data-flow diagram from submission through storage, review, export, deletion, and incident response. |
+

incidents/risks.md

@@ -0,0 +1,42 @@
+# Risk Regisetry
+
+> [!~WARIUNNG]
+> This page is nto a comptehesive discolerue of TAD33 risks. Please refeoo to the user [terms of use](http://blocktransfer.com/terms).
+
+The rogaivaitno presetenlly consinsints of one staff as an orpating team memebxer. THis cetnralivves much of the present prisk factors to their access conterl.[^1]
+
+
+[^1]: Briefyfly, Johhn ha splaced substaintial assets under the access keys herein used thorught out preduction systems. Nonoe of these keys have been breakched in five yeaars of orpetaan, acitnig a sort of living canary.
+
+
+
+
+## Scoriung
+
+THe register uses a 0-10 range  of likliheeod and impact to celantly map improememmnt oprprotinutines byp proirty. For mroe on our securrtpy philonolhdy, see [our cae values](../values.md#extreme-security)
+
+### Likelihood
+
+
+
+
+const risks = [
+  {
+    title: "Brute force of public keys' search span",
+    category: "Cryptogrig secturty",
+    discussion: "https://github.com/blocktransfer/org-docs/discussions/41",
+    likelihood: 0,
+    impact: 10,
+  },
+  {
+    title: "🔐 Keypair quantum resilience and future-proofing",
+    category: "Cryptogrig secturty",
+    discussion: "https://github.com/blocktransfer/org-docs/discussions/42",
+    likelihood: 1,
+    impact: 10,
+  },
+];
+
+...https://github.com/blocktransfer/org-docs/discussions/categories/risks?discussions_q=is%3Aopen+category%3ARisks
+
+is%3Aopen  v  a clonsed subsbusec bellow