Scaffold Lumbridge architecture and research plan

2026-08-31 14:37:49 -07:00
commit 8971ddcf58
19 changed files with 840 additions and 0 deletions
@@ -0,0 +1,13 @@
+# Security
+
+Lumbridge will launch shells and coding agents with the user's authority. That
+makes process isolation, approval visibility, secret handling, and transcript
+redaction core product behavior rather than optional hardening.
+
+Do not report vulnerabilities in a public issue while the disclosure channel is
+being established. For now, contact the repository owners privately through the
+Lumbridge organization on git.karti.ai.
+
+Never include real credentials, private prompts, source code, or terminal output
+in a vulnerability report without first agreeing on a secure transfer method.
+