weeks of bullshit

2026-04-17 08:18:11 +02:00
parent b5d4481502
commit 9efbe38c0c
157 changed files with 5171 additions and 1273 deletions
@@ -0,0 +1,11 @@
+# Security Policies
+
+Command safety is enforced before process execution.
+
+Modes:
+
+- `WARN`: allow unknown binary and log warning.
+- `BLOCK`: reject unknown binary.
+- `ALLOW`: skip safe-registry checks.
+
+Safe registry defaults include common package-manager executables and is configurable.