> ## Documentation Index
> Fetch the complete documentation index at: https://harisfazillah.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Policy - Deep State of Mind (DSOM)

> Security policy for the DSOM framework, covering supported versions and vulnerability reporting procedures. Deep State of Mind framework.

## Supported Versions

The **Deep State of Mind (DSOM) For My AI** framework follows a governance-tagged versioning scheme. Only the current active release branch receives security and governance updates.

| Version Series                 | Supported |
| :----------------------------- | :-------: |
| `v10.x.x-governance` (current) |     ✅     |
| `v9.x.x-governance`            |     ❌     |
| `v8.x.x` and earlier           |     ❌     |

> **Note:** DSOM is a governance and metacognitive framework, not a compiled application. "Security" in this context covers:
>
> * Sensitive data (credentials, IPs, tokens) accidentally committed to Git history.
> * Rogue or untrusted scripts introduced into `.agents/skills/` or `tools/`.
> * Insecure Ansible playbook patterns exposing remote node credentials.
> * Violations of the Zero-Trust and Privacy Guardian protocols.

***

## Reporting a Vulnerability

If you discover a security issue, including sensitive data in the repository, a vulnerable workflow, or a broken privacy control, please report it responsibly by following this procedure:

### 1. Private Disclosure (Preferred)

Do **not** open a public GitHub Issue for security vulnerabilities. Instead:

* Use **[GitHub Private Security Advisories](https://github.com/linuxmalaysia/deep-state-of-mind-for-my-ai/security/advisories/new)** to report the issue privately.
* Alternatively, contact the maintainer directly via the email listed on the [GitHub profile](https://github.com/linuxmalaysia).

### 2. What to Include

Provide as much detail as possible:

* A clear description of the vulnerability and its potential impact.
* Steps to reproduce or a proof-of-concept.
* Relevant file paths, commit hashes, or line numbers.
* Your suggested remediation (if any).

### 3. Response Timeline

| Stage                             | Target Timeframe                        |
| :-------------------------------- | :-------------------------------------- |
| Acknowledgement of report         | Within **72 hours**                     |
| Initial assessment & triage       | Within **7 days**                       |
| Remediation (patch/scrub)         | Within **14 days** (severity-dependent) |
| Public disclosure (if applicable) | After remediation is merged and pushed  |

### 4. DSOM-Specific Remediation Tools

The following built-in DSOM tools are available for security remediation:

| Tool                                   | Purpose                                                                                       |
| :------------------------------------- | :-------------------------------------------------------------------------------------------- |
| `tools/privacy-guardian.ps1` / `.sh`   | Scans active context manifests for credentials, IPs, and tokens before any external sync.     |
| `tools/audit-pre-flight.ps1` / `.sh`   | Validates repository state and OKF compliance before bulk operations.                         |
| `.agents/skills/git-history-scrubber/` | Purges sensitive data from Git history using `git-filter-repo`; handles force-push protocols. |
| `.agents/skills/forensic-log-audit/`   | Audits system and application logs for anomalies and failed authentications.                  |

***

## Scope

This security policy applies to:

* All files in this repository under the DSOM framework.
* All scripts in `tools/` and skills in `.agents/skills/`.
* All brain files in `.agents/brain/` (which may contain session context and node references).
* All GitHub Actions workflows in `.github/workflows/`.

***

*Deep State of Mind (DSOM) For My AI Protocol | Harisfazillah Jamel (LinuxMalaysia) | 2026-07-27*
*Standard: UK English | DBP-standard Bahasa Melayu Malaysia (Piawai) | GNU General Public License v3.0*


## Related topics

- [The Deep State of Mind (DSOM) Framework: Defense-in-Depth Architecture](/governance/dsom-architecture-analysis.md)
- [🧠 Deep State of Mind (DSOM) For My AI Protocol](/core-concepts.md)
- [Legal Notice & Disclaimer - Deep State of Mind (DSOM)](/legal-notice.md)
- [DSOM - Deep State of Mind: AI Governance Framework](/index.md)
- [🏛️ Digital Sovereignty Operational Model (DSOM)](/governance/digital-sovereignty-model.md)