| Page | What it covers |
|---|---|
| requirements.md | SR-01 to SR-36: what every SDK and the command line must do before 1.0, and how it is verified |
| threat-model.md | What we protect, the trust boundaries, threats and mitigations, residual risks |
| controls.md | How the repository maps to NIST SSDF, OpenSSF OSPS Baseline, CRA Annex I and SLSA |
| verifying-releases.md | How to check that a package you installed is the one we built |
| verifying-extensions.md | What iohr ext install checks, and how to check an extension by hand or for a mirror |
Policies at the repository root:
- SECURITY.md: reporting vulnerabilities, response targets, disclosure, CRA reporting.
- SUPPORT.md: supported versions and runtimes, the 5-year security support period.
- GOVERNANCE.md: maintainers, decisions, review controls, access continuity.
The decision behind all of this is ADR 0007.