Skip to main content

Security Policy for Physical Management

This document outlines security procedures and policies for the Physical Management module.

Reporting a Vulnerability​

If you discover a security vulnerability within this module, please report it to us as soon as possible. We take all security reports seriously.

DO NOT report security vulnerabilities through public GitHub issues.

Instead, please email blanket@activeinference.institute with the subject line: "SECURITY Vulnerability Report: Physical Management - Security Issue".

Please include the following information in your report:

  • A description of the vulnerability and its potential impact.
  • Steps to reproduce the vulnerability, including any specific configurations or conditions required.
  • Any proof-of-concept code or examples.
  • The version(s) of the module affected.
  • Your name and contact information (optional).

We aim to acknowledge receipt of your vulnerability report within 2-3 business days and will work with you to understand and remediate the issue. We may request additional information if needed.

Public disclosure of the vulnerability will be coordinated with you after the vulnerability has been fixed and an update is available, or after a reasonable period if a fix is not immediately possible.

Security Updates​

Security patches and updates for this module will be documented in the module changelog (if available) and released as part of regular version updates. Critical vulnerabilities may warrant out-of-band releases.

Scope​

This security policy applies to the Physical Management module within the Codomyrmex project.

Security Considerations​

  • Physical system management may involve sensitive operations
  • Device and sensor interactions require proper access controls
  • Simulation environments should be isolated from production systems

For project-wide security information, see the main Codomyrmex Security Policy.