coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A risk management service.
4 commits 1 branch 0 tags 849 KiB
Find a file
tegwick 38e083ed3d INTENT: the register is no longer empty, and the first finding tested the deferral 
Controlled disclosure was deferred to production on the reasoning that build
mode has no users to expose. The first finding to arrive is a live
authorization bypass in the service every other service trusts, where the
choice today is publish or hold with nothing between. The deferral may still be
right; it is now a decision with a real case in hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 22:52:37 +02:00
findings RISK-F-0001: flex-auth authenticates no caller on the decision surface 2026-08-17 22:51:31 +02:00
INTENT.md INTENT: the register is no longer empty, and the first finding tested the deferral 2026-08-17 22:52:37 +02:00
README.md Seed INTENT: risk register, regulatory intake, escalation duty 2026-08-17 15:55:30 +02:00

README.md

risk-nexus

Risk register and regulatory intake for the estate. Serves risk.coulomb.social. Owned by the-custodian.

Holds findings — security, architecture, operational, compliance — with a severity, an owner and a date; decides whether and when each is published; and decides which must reach the operator personally rather than sitting in a register.

It does not fix things: findings route to the repo that owns the defect. It does not host: policy-nexus is the publication surface.

  • Intent: INTENT.md