Security Disclosure Policy

Security Policy v2.0

Version 2.0 · 2026-08-20 · Governance 2.0 public evidence surface

Governance 2.0 Overview

This page is part of the starnum public Governance 2.0 surface and uses the same evidence layer as the system card, data governance, transparency report, use policy, and security policy.

Governance Summary

This page defines how security contact, disclosure boundaries, crawler access, and release integrity are publicly documented.

Scope

security.txt route, crawler policy, deployable security artifacts, disclosure constraints, GPG state, and evidence registry links.

Implementation Status

Version 2.0 keeps security details public enough for verification without exposing secrets or exploitable internals.

starnum.com.tw values the security of user data and the website. We welcome security researchers to report potential vulnerabilities through responsible disclosure, and we commit to responding openly, respectfully, and promptly.

Contact

Please report security issues through the following channel:

Instagram DM: @mychenan (received directly by the astrologer — all security issues should go through this channel)

This site is operated by a single person. The astrologer handles reports directly, which is faster than traditional email.

Machine-readable version: /.well-known/security.txt (compliant with RFC 9116)

Scope

Primary domain: starnum.com.tw and all subdomains
Cloudflare Workers (API endpoints)
Frontend HTML/JS/CSS (XSS, content injection)
Supabase backend data access control
Authentication and authorization flows

Out of scope: Third-party services (Cloudflare infrastructure itself, Google Analytics, Supabase platform itself), social engineering attacks, physical security.

What to Include in Your Report

Vulnerability description and impact scope
Steps to reproduce (the more detail, the better)
Affected URL(s) / component(s)
Screenshots or PoC (Proof of Concept), if applicable
How you would like to be credited (public / anonymous)

Timeline Commitments

Milestone	Target Timeline
Acknowledgement of receipt	Within 3 business days
Initial assessment and severity classification	Within 7 business days
Low/medium risk fix	Within 30 days
High risk fix	Within 60 days
Critical vulnerability fix	Within 90 days (will notify proactively if more time is needed)
Public disclosure (coordinated)	After fix is complete, timing coordinated with researcher

Our Commitments

Confirm receipt of your report and maintain communication throughout
Not take legal action against researchers who report in good faith
Notify you after the fix, and publicly acknowledge you with your consent
If you wish to be credited publicly, list your name or handle on our thanks page

Researcher Rules

Do not access or modify other users' data
Do not conduct denial-of-service (DoS/DDoS) testing
Do not publicly disclose vulnerabilities until we confirm the fix is complete
Testing scope is limited to the Scope listed above

Hall of Thanks

We thank the following security researchers for helping improve the security of starnum.com.tw:

(The first reporter will be permanently recorded here)

HTTPS and Data Security

Site-wide enforced HTTPS (Cloudflare Pages + HSTS preload)
HTTP security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Dependency vulnerability scanning performed locally on a regular basis
Pre-commit hook automatically checks for API key leaks and merge conflict markers

External standards and primary sources

These primary sources inform this page. They are benchmarks, not third-party endorsements of this site.

Current Machine Audit Snapshot

This block uses only traceable local audit data. No unsupported metrics or model claims are added.

2026-08-20

Maintained

17/17

LLM loops

180/180

Governance pages

JSON-LD errors

32,724

KB chunks (HEALTHY)

512,152

TM entries; verified 6,250

7,976/7,976

AI answer-ready; failures 0

critical

Status page: 3 critical, 1 warnings

data/state-machine/i18n-parity.json: 8,036 parent URLs, 7,976 articles.
data/kb-machine-audit.json: 3,238 source files, 0 missing coverage, 0 orphan chunks.
data/discovery-surface-audit.json: 0 errors, 0 warnings.
data/sla-report.json: critical / 3 critical, 1 warnings.

Content Maintenance And Update Decision

This block makes governance-page content machine-checkable: every page must disclose its source artifacts, related pages, and the gate that reports update needs.

Update Decision

This is not static copy. When source artifacts, related policies, public metrics, or generators change, AI Ops reports evidence and an AI agent decides whether the page needs edits.

Human Boundary

Systems detect, report, and preserve machine-readable evidence. Codex/Claude agents perform final judgment and repair.

Verification Command

node scripts/verify-trust-pages.js --check

data/sla-report.json
data/public-claim-registry.json
data/discovery-surface-audit.json
Related governance pages: Privacy Policy · AI Safety · Acceptable Use Policy · Transparency Report
Update flow: npm run update:trust-pages → npm run test:trust

Verifiable Evidence Layer

This block is not a narrative claim. Each core assertion has a claim id, source JSON, hash, and a repeatable verification command. Public pages disclose governance evidence without exposing source code, secrets, private data, or exploitable attack details.

Claim ID	Verifiable value	Status	Owner	Source and verification
claim.public-url-manifest.indexable-count Public URL and canonical inventory	39,104 indexable URLs	verified	sitewide	`node scripts/generate-public-evidence-manifest.js --dry`
claim.trust-pages.audit-pass-rate Trust page machine audit	180/180 pass	verified	sitewide	`node scripts/verify-trust-pages.js --check`
claim.discovery-surface.zero-errors AI discovery surface audit	{"errors":0,"warnings":0}	verified	sitewide	`node scripts/verify-discovery-surface.js`
claim.structured-data.jsonld-errors JSON-LD / structured data audit	{"structured_data_invalid_files":0,"breadcrumb_count":28274,"faq_count":27506,"dataset_count":30,"article_count":27406}	verified	sitewide	`node scripts/site-machine-audit.js`
claim.status.sla-state Status page SLA source	critical / 4 critical, 0 warnings	verified	sitewide	`node scripts/generate-status-page.js`
claim.provider-alignment.openai-anthropic-gemini OpenAI / Anthropic / Google Gemini benchmark alignment	benchmark alignment only unless code/config evidence exists	verified	sitewide	`node scripts/verify-public-evidence.js --check`
claim.transparency-report.sha256 Transparency report SHA-256 anchor	{"report":"transparency/report-2026-Q3.json","sha256":"f154fc87139b42098b02567fc93582c30addafc406420b3aea8bae79b6f4ac93"}	verified	sitewide	`node scripts/update-transparency-current-data.js`
claim.release-integrity.gpg-signing GPG signing status	GPG signing active locally; checked GitHub commit verification is valid	verified	sitewide	`gpg --list-secret-keys --keyid-format=long && git log -1 --show-signature`
claim.security-policy.security-header-state Security-header state machine	{"state":"A_GRADE"}	verified	security-policy	`node scripts/verify-public-evidence.js --check`
claim.security-policy.security-txt-route Machine-readable security.txt route	{"publicPath":"/.well-known/security.txt"}	verified	security-policy	`node scripts/repair-internal-links.js --check`
claim.security-policy.crawler-access AI crawler discovery access control	{"artifacts":["/robots.txt","/llms.txt","/.well-known/llms.txt"]}	verified	security-policy	`node scripts/verify-discovery-surface.js`

public-evidence-manifest.json public-claim-registry.json public-verification-report.json public-url-manifest.json

System Card V2.0: Technical Transparency Layer

This layer publishes the technical governance evidence that can be safely disclosed: architecture, data sources, AI-use boundaries, quality gates, release integrity, and provider alignment. Source code, secrets, exploitable attack details, and private data remain out of scope.

Public architecture

Cloudflare Workers, R2/D1/KV, and local generation scripts form the public-site and governance publication chain. Public pages disclose behavior, state, and traceable sources, not secrets or internal permissions.

AI-use disclosure

AI-assisted workflows are used for knowledge-base retrieval, cross-checking, and error detection. Governance documents are benchmarked against OpenAI, Anthropic, and Google Gemini public frameworks. Production model usage is disclosed only when code/config evidence exists.

Quality and safety gates

Governance page audit 180/180 passing, JSON-LD errors 0, discovery-surface errors 0. Status pages report critical / 3 critical, 1 warnings as-is.

Data traceability

Knowledge base 32,724 chunks, TM 512,152 entries, AI answer-ready 7,976/7,976. Public metrics trace to data/state-machine/*, data/*audit*.json, and transparency reports.

Governance area	OpenAI	Anthropic	Google Gemini	Starnum implementation evidence
Model/system-card disclosure	OpenAI models + safety docs	Claude model docs + system/model cards	Gemini model docs + safety settings	system-card, model-card, methodology, benchmark, transparency-log
Safety evaluation and use boundaries	Safety best practices / deployment checklist	Responsible Scaling / safety policy	Gemini safety controls / policy	AI safety, acceptable-use, ethics, risk-boundary copy, crawler policy audit
Data governance	Data controls / privacy controls	privacy and data handling docs	Gemini API data governance references	privacy, ai-data-governance, KB/TM source tracking, SHA-256 hashes
Monitoring and release	production checklist / eval discipline	system-card transparency discipline	model/version documentation discipline	deploy.js, status.html, SLA report, trust-pages-machine-audit, sitemap/hreflang audits

Sources: data/state-machine/model-card.json, public-bench.json, trust-pages.json, security-headers.json.
Sources: data/trust-pages-machine-audit.json, data/discovery-surface-audit.json, data/ai-answer-readiness-audit.json.
Sources: data/kb-machine-audit.json, data/tm/quality-audit-report.json, data/sla-report.json.
Official benchmark docs checked: 2026-08-20; links are listed in the OpenAI / Anthropic / Google Gemini alignment table.

The V2.0 goal is not more claims; it separates implemented controls from planned controls. Production usage, benchmark alignment, status exceptions, GPG signing, and SLA breaches are disclosed from source data.

Release Integrity And GPG

GPG signing active. signingkey=0934DFA0EDA6363A. Checked GitHub commit verification is valid.

OpenAI / Anthropic / Google Gemini Alignment

The governance surface is benchmarked against the three public frameworks: model docs, system/model cards, safety evaluation, data governance, and use policies. This is benchmark alignment, not a claim that every provider is active in production inference. Official docs checked: 2026-08-20

Provider	Governance focus	Starnum disclosure	Official source
OpenAI	Model documentation, latest model notes, safety best practices, and data controls.	No verifiable production model setting was found in the production code scan; providers are listed as governance benchmarks.	https://platform.openai.com/docs/models
Anthropic	Claude model documentation, system/model cards, Responsible Scaling, and safety policy.	No verifiable production model setting was found in the production code scan; providers are listed as governance benchmarks.	https://docs.anthropic.com/en/docs/about-claude/models
Google Gemini	Gemini API model documentation, safety settings, data governance, and platform policy.	No verifiable production model setting was found in the production code scan; providers are listed as governance benchmarks.	https://ai.google.dev/gemini-api/docs/models