docs: add SECURITY.md with WebSocket and branch protection guidelines

2026-04-15 12:38:26 +00:00
1 changed files with 17 additions and 0 deletions
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -0,0 +1,17 @@
+
+# Security Policy
+
+## WebSocket Security
+The Nexus WebSocket gateway (`server.py`) is restricted to `127.0.0.1` by default to prevent unauthorized remote access to the cognition layer.
+
+### Remote Access
+If remote access is required, you must:
+1. Set `NEXUS_WS_HOST=0.0.0.0`
+2. Provide a secure `NEXUS_WS_AUTH_TOKEN`
+
+## Branch Protection
+We enforce rebase-before-merge to ensure a clean, linear history. Please rebase your branches against `main` before submitting for final review.
+
+## Reporting Vulnerabilities
+Please report any security concerns directly to the Timmy Foundation core team.
+