We take security seriously. If you discover a security vulnerability, please follow responsible disclosure practices.

1. Do NOT open a public issue for security vulnerabilities
2. Send a detailed report to: security@panoptes.example.com (or open a confidential issue on GitLab)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgement of your report within 24 hours
• Regular updates on the status of your report
• Credit in the security advisory (if desired)
• No legal action for responsible disclosure

Panoptes follows defense-in-depth security principles:

1. Memory Safety: Written in Rust with no unsafe blocks
2. Minimal Privileges: Runs as non-root user in containers
3. Local Processing: No data leaves your machine
4. Input Validation: All file inputs are sanitized
5. Container Isolation: Podman rootless containers

+------------------+     +------------------+     +------------------+
|   User Files     | --> |    Panoptes      | --> |    Ollama        |
| (untrusted input)|     |   (sandboxed)    |     | (containerized)  |
+------------------+     +------------------+     +------------------+
                              |
                              v
                         +----------+
                         | Renamed  |
                         |  Files   |
                         +----------+

• All dependencies are audited via cargo audit
• No floating version ranges (pinned versions)
• Regular dependency updates via Dependabot/Renovate
• SBOM generation available: just sbom-generate

Before submitting code:

• No unsafe Rust code without justification
• All inputs validated and sanitized
• No hardcoded credentials or secrets
• SPDX headers present
• cargo audit passes
• cargo clippy passes with no warnings

1. File System Permissions: Panoptes operates with user permissions; ensure watched directories have appropriate access controls
2. Network Exposure: Ollama API (port 11434) is bound to localhost only
3. Model Trust: We use Moondream from official Ollama registry; verify model integrity

Security advisories will be published via:

• GitLab Security Advisories
• CHANGELOG.md entries tagged [SECURITY]
• Direct notification to known affected users

This project maintains:

• RSR Gold compliance
• SPDX license headers on all files
• Dependency vulnerability scanning
• Secure container base images (Chainguard Wolfi)