This portal manages physical agricultural telemetry and irrigation logic for Coastal Alpine Tech Limited. Access to the main branch is strictly restricted to authorized architects.
We treat agricultural system vulnerabilities as critical. A flaw here impacts physical crops and food sovereignty. If you discover a vulnerability in SoilGuard's authentication, telemetry ingestion, or MQTT bridging, DO NOT open a public issue. Report it directly to the Chief Architect.
| Channel | Response |
|---|---|
| Dependabot | Weekly dependency PRs - prioritise security / high CVEs |
| Code scanning / SecOps / Red team | Fix-forward on main; never weaken actuator guards |
| Coastal-Alpine-Core advisories | Bump core pin; re-run portal tests |
| Org threat register | See coastal-alpine-stack SECURITY.md / SECURITY_POSTURE_REPORT.md |
| ID / finding | Mitigation |
|---|---|
| GHSA-f4xh-w4cj-qxq8 langsmith | Floor >=0.8.18 via stack/Weaver pins |
| GHSA-4xgf-cpjx-pc3j pydantic-settings | Floor >=2.14.2 |
| GHSA-f4j7-r4q5-qw2c chromadb | Local-only vector DB; no public bind |
| Prompt injection | Core SecurityGuard on all LLM prompts |
| GITHUB_TOKEN | CI workflows use permissions: contents: read |
- Portal CI + SecOps (Bandit/Gitleaks) + red-team schedules.
- Actuator / irrigation / crop actions must remain fail-closed on guard failure.
- No silent exfiltration of personal or tenant operational data
- Prefer local-first processing; third-party AI only with explicit operator configuration and UI/docs disclosure
- Report vulnerabilities via GitHub Security Advisories or the maintainer contact on the org profile
- High-stakes production changes require human approval (HITL)
- We do not sell personal information or customer operational data to third parties.
- Optional AI or cloud services run only when configured by the operator; processing must be disclosed (in-product and/or docs).
- Prefer local-first paths so third-party transfer is unnecessary by default.
- Design in accordance with the Privacy Act 2020.
- Operate in accordance with Te Mana Raraunga principles for Māori data sovereignty interests.
- Align AI features with NZ AI safety / responsible AI expectations (HITL, transparency, no silent training on private content).