Security & responsible disclosure

ILM is a research project served as static pages plus open-source tooling. We still take security and safety seriously.

Report a vulnerability

Please use GitHub private security advisories on the relevant repo (Security → Report a vulnerability) rather than a public issue. We aim to acknowledge within a reasonable time and to credit reporters who wish it.

Scope

• The site (project-ilm/ilm.codes) and the kernel/tooling repos.
• Supply-chain concerns (CDN, dependencies) — flag them.
• Out of scope: third-party hosts (GitHub, Cloudflare) — report to them directly.

Hardening we ask maintainers to enable

• Branch protection on main (require PR review; no force-push).
• Dependabot alerts + secret scanning + push protection (org-wide).
• 2FA required for the org; least-privilege collaborator roles.
• Signed commits/tags for releases where feasible.
• CodeQL on code repos; pin GitHub Actions by SHA.

Do not test against third-party infrastructure. No social engineering of maintainers or contributors.