David Snelling a99b1e83c4 chore: rename to @soulcraftlabs/brainy for Open Brainy on The Source

Prepares the repo for its new home at soulcraftlabs/open-brainy ahead
of the Forgejo transfer: package name, publish registry, release
script, and every install/import reference across docs, src, tests,
examples, and integrations now point at @soulcraftlabs/brainy on
The Source. The npmjs storefront leg and byte-identity pair
verification are stripped from the release script — The Source is
now the only publish target. README gains an Open Brainy explainer
and a registry note for consumers.

@soulcraft/brainy 10.4.2 was the last release under the old name.

2026-08-27 17:07:09 -07:00

1.4 KiB

Raw Blame History

Security Policy

Reporting a vulnerability

Email security@soulcraft.com. That's the one door for security reports across the company, and it works the same way for Brainy: every report is read by a human, you'll get a private receipt, and we'll work with you on coordinated disclosure — please don't open a public issue for anything that isn't already public.

Include what you'd want if you were on the other end: affected version, how to reproduce, and what you think the impact is. If you have a patch or a suggested fix, send it along — it's welcome but not required.

There is no bounty program today. We're saying that plainly so you know what to expect going in.

Response time

We respond as fast as truth allows. That means: no fixed SLA, no promise of a reply within a specific number of hours — but a real report from a real person gets read promptly and taken seriously. If you haven't heard anything in a reasonable stretch, a follow-up email is completely fine.

Supported versions

The latest 8.x minor release line receives security fixes. If you're running an older major version, please upgrade before reporting — we can't commit to backporting fixes to unsupported lines.

Scope

This policy covers the @soulcraftlabs/brainy package itself — the code in this repository. If you're evaluating a deployment that also uses @soulcraft/cor, report issues in that package the same way, to the same address; we'll route internally.