Add SECURITY.md

Author: blackboxprogramming

SECURITY.md

@@ -1,92 +1,24 @@
 # Security Policy
 
-## Reporting a Vulnerability
+## Reporting Vulnerabilities
 
-**Do not** open a public GitHub issue for security vulnerabilities.
+Email: alexa@blackroad.io
 
-Email **security@blackroad.io** with:
-
-1. Description of the vulnerability
-2. Steps to reproduce
-3. Potential impact
-4. Suggested fix (if any)
-
-### Response Timeline
-
-| Phase | Timeline |
-|-------|----------|
-| Initial response | 24 hours |
-| Triage and assessment | 72 hours |
-| Fix development | 7-14 days |
-| Coordinated disclosure | 90 days |
+Do NOT open public issues for security vulnerabilities.
 
 ## Supported Versions
 
-| Version | Status |
-|---------|--------|
-| Latest on `main` | Active support |
-| Previous releases | Security fixes only |
-
-## Architecture
-
-All LLM provider communication flows through the tokenless gateway. Agents never embed API keys.
-
-```
-Agent --> Gateway (localhost:8787) --> Provider (Ollama / Claude / OpenAI)
-```
-
-### Authentication
-
-| Component | Method |
-|-----------|--------|
-| API | JWT via auth.blackroad.io |
-| CLI | Token-based |
-| Fleet SSH | Public key authentication |
-| Cloudflare Workers | Wrangler auth |
-| MCP Bridge | Bearer token |
-
-### Infrastructure Security
+Only the latest version on `main` is supported.
 
-- **Cloudflare Tunnel** terminates TLS for all public endpoints
-- **WireGuard** encrypts all inter-node traffic (10.8.0.x mesh)
-- **Pi-hole** filters DNS on the fleet
-- **UFW** on Lucidia (INPUT DROP policy)
-- **NOPASSWD sudo** limited to operational users on each node
-- **Secrets** stored in `~/.blackroad/` with 600 permissions, never in code
+## Security Practices
 
-### Automated Scanning
-
-| Scan | Tool | Frequency |
-|------|------|-----------|
-| Static analysis | CodeQL | Every PR |
-| Dependencies | Dependabot | Daily |
-| Secret detection | GitHub Secret Scanning | Every commit |
-| Shell linting | ShellCheck | CI on every push |
-
-## For Contributors
-
-1. Never commit secrets, tokens, or credentials
-2. Use environment variables or `.env` files (gitignored)
-3. Use parameterized queries for all database access
-4. Validate input at system boundaries
-5. Keep dependencies updated (`npm audit`, `pip-audit`)
-
-## Scope
-
-| In Scope | Out of Scope |
-|----------|--------------|
-| *.blackroad.io | Third-party services |
-| API endpoints | Social engineering |
-| Agent infrastructure | Physical access attacks |
-| Authentication and authorization | Denial of service |
-
-## Contact
-
-| Role | Contact |
-|------|---------|
-| Security Lead | security@blackroad.io |
-| Backup | blackroad.systems@gmail.com |
+- All secrets in env files with chmod 600
+- No API tokens in code
+- WireGuard for inter-node traffic
+- Cloudflare proxy for all public endpoints
+- UFW on all exposed nodes
+- SSH key auth only (password auth disabled)
+- Quarterly SSH key audit
 
 ---
-
-BlackRoad OS, Inc. -- Pave Tomorrow.
+*BlackRoad OS, Inc. All rights reserved.*