Security & Contact

Hummingbird's repository is public and Phase 2 — Read-Only Commons is in progress. Public page views remain open and largely static. The bounded first-party /offer pilot accepts temporary non-canonical offers without an account, while the interim Seed Bank uses public GitHub issues. The offer pilot uses a dedicated temporary store separate from the Cloudflare D1 database holding deliberately admitted canonical records. Durable Phase 3 participant capabilities remain gated.

main is protected with required CI and admin/steward enforcement. Repository Actions are restricted and SHA-pinned. Secret scanning, push protection, Dependabot security controls, and CodeQL default setup are enabled.

The ordinary Pages deployment credential remains narrowly scoped to deployment. D1 persistence and the guarded recovery exercise use separate operational credentials rather than widening the public-site deployment token; no credential values are stored in the repository or exposed on public pages.

Do not open a public issue containing vulnerability details. GitHub private vulnerability reporting is enabled for this repository. Use the repository's Security → Report a vulnerability flow to send a private report to the maintainer.

The repository's SECURITY.md is the authoritative source for the current threat model, controls, retention rules, and security guidance. Public security-related architectural decisions that are safe to disclose are indexed in the Decision Record.