{
  "$schema": "./schemas/security.schema.json",
  "$comment": "MarinOS's own security.json, built from schemas/profiles/internal.json (matching marin.yml's audience: staff) with no overrides yet. Demonstrates the standard on the platform itself, per marin-digital-standards/security/standard.md.",
  "schema": 1,
  "profile": "internal",
  "securityTxt": {
    "enabled": true,
    "contact": ["mailto:innovation@marincounty.gov"],
    "preferredLanguages": ["en"],
    "expires": "2027-09-25T00:00:00.000Z"
  },
  "transport": {
    "httpsRequired": true,
    "httpRedirect": true,
    "hsts": { "status": "inherited-from-platform" }
  },
  "headers": {
    "contentTypeOptions": { "status": "not-achievable", "notes": "GitHub Pages does not serve custom HTTP response headers." },
    "referrerPolicy": { "status": "enabled-via-meta", "value": "strict-origin-when-cross-origin" },
    "permissionsPolicy": { "status": "not-achievable", "notes": "GitHub Pages does not serve custom HTTP response headers." },
    "frameProtection": { "status": "not-achievable", "notes": "Requires a header (X-Frame-Options) or a directive meta-delivered CSP ignores (frame-ancestors); neither is available on GitHub Pages." }
  },
  "csp": {
    "deliveryMechanism": "meta",
    "directives": {
      "default-src": ["'self'"],
      "script-src": ["'self'"],
      "style-src": ["'self'"],
      "img-src": ["'self'"],
      "font-src": ["'self'"],
      "connect-src": ["'self'", "https://api.github.com"],
      "object-src": ["'none'"],
      "base-uri": ["'self'"],
      "form-action": ["'self'"]
    }
  },
  "authentication": { "required": false },
  "authorization": { "required": false, "serverSideEnforced": false },
  "data": {
    "collectsUserData": false,
    "collectsSensitiveData": false,
    "storesPersonalInformation": false,
    "acceptsUserSubmittedContent": false,
    "externalDataSources": ["GitHub API (catalog.json cross-repo checks)"]
  },
  "dependencies": {
    "lockfileRequired": false,
    "runtimeCdnPolicy": "see marin-digital-standards/product-design/runtime-dependencies.md",
    "thirdPartyDependencyReview": true,
    "dependencyScanning": { "status": "enabled", "provider": "github-advanced-security" }
  },
  "secrets": {
    "clientSideSecretsProhibited": true,
    "committedSecretsProhibited": true,
    "repositoryScanning": { "status": "enabled", "provider": "github-advanced-security" }
  },
  "monitoring": {
    "secretScanning": { "status": "enabled", "provider": "github-advanced-security", "lastChecked": "2026-09-25" },
    "pushProtection": { "status": "enabled", "provider": "github-advanced-security", "lastChecked": "2026-09-25" },
    "dependabotSecurityUpdates": { "status": "enabled", "provider": "github-advanced-security", "lastChecked": "2026-09-25" }
  },
  "exceptions": [
    {
      "control": "Clickjacking protection (frame-ancestors / X-Frame-Options)",
      "reason": "GitHub Pages cannot serve custom HTTP headers, and meta-delivered CSP ignores frame-ancestors.",
      "riskDescription": "MarinOS could theoretically be framed by another site. Low impact: the platform hub has no authentication, no session state, and no destructive actions reachable without leaving the frame context (every real action navigates to a different app's own origin).",
      "owner": "MarinOS platform team",
      "expires": "2027-09-25"
    },
    {
      "control": "MIME-sniffing protection (X-Content-Type-Options) and Permissions-Policy",
      "reason": "Both require a real HTTP response header, which GitHub Pages does not serve.",
      "riskDescription": "Standing gap shared by every MarinOS app on this hosting stack, not specific to marin-os. See marin-digital-standards/security/standard.md.",
      "owner": "MarinOS platform team",
      "expires": "2027-09-25"
    }
  ],
  "publicSecurity": {
    "lastReviewed": "2026-09-25",
    "controls": ["HTTPS", "Content Security Policy", "Dependency monitoring", "Secret scanning"],
    "data": { "collectsPersonalData": false }
  },
  "review": {
    "lastReviewed": "2026-09-25",
    "owner": "MarinOS platform team"
  }
}