Skip to content

Security: jeranaias/ExpertDrivenDevelopment

Security

SECURITY.md

Security Policy

Classification Notice

All materials in this repository are UNCLASSIFIED and approved for public release.

This repository contains open-source training materials for Department of War (DoW) personnel on AI-assisted development methodologies. Every file, document, code sample, and example within this repository must be and remain UNCLASSIFIED at all times.

Prohibited Content

The following categories of information are strictly prohibited from being committed to this repository:

  • Classified Information of any level (CONFIDENTIAL, SECRET, TOP SECRET, or any compartmented programs)
  • Controlled Unclassified Information (CUI)
  • Personally Identifiable Information (PII), including but not limited to real names of students or trainees, Social Security Numbers, DoW ID numbers, EDIPI numbers, phone numbers, home addresses, or personal email addresses
  • Protected Health Information (PHI)
  • Real operational data, including operational plans, schedules, operational intelligence products, unit-specific procedures, deployment information, or operationally sensitive material
  • Real student data or real personnel data
  • Real .mil email addresses (other than the project POC)
  • Export-controlled technical data under ITAR or EAR

Use of Fictional Data

All examples, sample data, scenarios, and demonstrations in this repository must use fictional names, units, and data (e.g., "Sgt Smith," "LCpl Example"). Contributors must ensure that:

  • No real personnel, students, or operational information is referenced in any committed content.
  • No screenshots containing real personnel data are included.
  • No operational data from any unit is present.

Contributor Responsibility

All contributors are personally responsible for verifying that their submissions contain only UNCLASSIFIED information before committing to this repository. By submitting a pull request or committing content, you affirm that:

  1. The content is UNCLASSIFIED and approved for public release.
  2. The content contains no CUI, PII, PHI, or classified information.
  3. All names, data, and scenarios are fictional.
  4. The content does not violate any DoW information security policies.

When in doubt, do not commit. Contact the POC first.

Reporting Sensitive Data Exposure

If you discover that sensitive, controlled, or classified information has been accidentally committed to this repository, take the following steps immediately:

  1. Do not share or distribute the affected content further.

  2. Open an issue in this repository with the title: [SECURITY] Potential Sensitive Data Exposure -- do not include the sensitive data itself in the issue.

  3. Contact the project point of contact directly:

    SSgt Jesse C. Morgan Marine Corps Detachment, Presidio of Monterey Defense Language Institute Foreign Language Center (DLIFLC) Email: jesse.morgan@dliflc.edu

  4. If the POC is unavailable, contact your local cybersecurity office.

  5. The repository maintainers will take immediate action to remove the content from the repository and its history.

DoW Open Source Policy Reference

This project operates in accordance with the following DoW policies and guidance on open-source software:

  • DoW Memorandum: "Clarifying Guidance Regarding Open Source Software (OSS)" -- establishes that open-source software may be developed and released by DoW organizations when appropriate.
  • DoW CIO Memo on Public Code Repositories -- provides guidance on the use of public repositories for DoW projects.
  • DoW Instruction 8500.01, Cybersecurity -- provides overarching cybersecurity policy for DoW information systems.
  • DoW Directive 5230.09, Clearance of DoW Information for Public Release -- governs the review and approval process for releasing DoW information to the public.
  • DoWI 5400.11-R, DoW Privacy Program -- establishes policy for the protection of personally identifiable information.
  • Defense Open Source Software (OSS) FAQ -- published by the DoW CIO, providing guidance on the use and contribution to open-source projects.

Contributors are encouraged to familiarize themselves with these policies to ensure full compliance.

Point of Contact

For questions regarding security policy, classification concerns, or to report a potential security issue:

SSgt Jesse C. Morgan Marine Corps Detachment, Presidio of Monterey Defense Language Institute Foreign Language Center (DLIFLC) Email: jesse.morgan@dliflc.edu

There aren’t any published security advisories