🔐 Security Policy — Riksdagsmonitor

🛡️ Security Through Transparency and Vulnerability Management
🎯 Defense-in-Depth Architecture for Democratic Intelligence

📋 Document Owner: CEO | 📄 Version: 1.0 | 📅 Last Updated: 2026-02-20 (UTC)
🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-05-20
🏢 Owner: Hack23 AB (Org.nr 5595347807) | 🏷️ Classification: Public

🎯 Purpose Statement

This security policy establishes vulnerability disclosure and incident response procedures for Riksdagsmonitor, implementing Vulnerability Management and Incident Response Plan from Hack23 AB's ISMS framework.

Our security approach demonstrates our commitment to transparency and operational excellence, ensuring that vulnerabilities are managed systematically with documented response times and coordinated disclosure processes.

— James Pether Sörling, CEO/Founder

Supported Versions

This project is under active development, and we provide security updates for the latest version only.

Security Posture

Riksdagsmonitor maintains strong security practices as documented in our Security Architecture:

Current Security Controls

• ✅ Static Site Architecture — No server-side code execution, no database vulnerabilities
• ✅ HTTPS-Only — TLS 1.3 via AWS CloudFront and GitHub Pages
• ✅ Automated Security Scanning — CodeQL, Dependabot, Secret Scanning
• ✅ Supply Chain Security — SHA-pinned GitHub Actions, step-security/harden-runner
• ✅ Multi-Region Availability — AWS CloudFront (us-east-1 primary, eu-west-1 replica) with GitHub Pages DR
• ✅ SLSA Build Provenance — Attestation for build integrity
• ✅ Content Integrity — Subresource Integrity (SRI) for CDN assets
• ✅ Security Headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options

Evidence:

• 
• Security Overview

🛰️ Third-Party Supply-Chain Scanner Disposition (Socket.dev)

The published riksdagsmonitor npm package is scanned by Socket.dev. The following package-level alerts have been reviewed and are documented here for transparency:

If you observe additional Socket alerts on a future version, please open a private security advisory via GitHub Security Advisories.

Reporting a Vulnerability

We take the security of Riksdagsmonitor seriously. If you have found a potential security vulnerability, we kindly ask you to report it privately, so that we can assess and address the issue before it becomes publicly known.

What Constitutes a Vulnerability

A vulnerability is a weakness or flaw in the project that can be exploited to compromise the security, integrity, or availability of the system or its data. Examples include, but are not limited to:

• Cross-site scripting (XSS) in generated content
• Insecure external resource loading
• Exposed secrets or credentials
• Supply chain vulnerabilities in dependencies
• Content injection through data pipelines

In-scope components

The following components are within the disclosure scope and welcome responsible-disclosure reports:

• Static site — all HTML/CSS/JS served from / and /dashboard/ and /news/.
• News generation pipeline:
  • scripts/aggregate-analysis.ts — concatenates analysis/daily/$DATE/$SUB/ artifacts into article.md + SHA-256 manifest.
  • scripts/render-articles.ts — markdown → sanitised HTML pipeline.
  • scripts/render-lib/ — shared chrome (header, footer, language switcher, JSON-LD NewsArticle shell) and the rehype-sanitize allow-list.
  • scripts/validate-news-translations.ts — translation-completeness validator.
• Index generators — scripts/generate-sitemap*.ts, scripts/generate-rss.ts, scripts/generate-news-indexes.ts, scripts/generate-political-intelligence.ts.
• Agentic workflows — 11 workflows in .github/workflows/news-*.md + their compiled .lock.yml peers, plus the non-agentic CI/CD pipelines in .github/workflows/.
• MCP configuration — .github/copilot-mcp.json and per-workflow mcp-servers: blocks.

How to Privately Report a Vulnerability using GitHub

1. On GitHub.com, navigate to the main page of the riksdagsmonitor repository.
2. Under the repository name, click Security.
3. In the left sidebar, under "Reporting", click Advisories.
4. Click Report a vulnerability to open the advisory form.
5. Fill in the advisory details form with as much information as possible.
6. At the bottom of the form, click Submit report.

Disclosure Timeline

Upon receipt of a vulnerability report, our team will:

1. Acknowledge the report within 48 hours
2. Validate the vulnerability within 7 days
3. Develop and release a patch or mitigation within 30 days (depending on complexity and severity)
4. Publish a security advisory with a detailed description of the vulnerability and the fix

Recognition and Anonymity

We appreciate your effort in helping us maintain a secure project. If your report results in a confirmed security fix, we will recognize your contribution in the release notes, unless you request to remain anonymous.

🔐 ISMS Framework Integration

Riksdagsmonitor's security practices are part of Hack23 AB's comprehensive Information Security Management System (ISMS):

📋 Related ISMS Policies

🔍 Comprehensive Security Documentation

• 🛡️ Security Architecture: SECURITY_ARCHITECTURE.md — Defense-in-depth controls
• 🎯 Threat Model: THREAT_MODEL.md — STRIDE analysis, MITRE ATT&CK mapping
• 🔮 Future Security: FUTURE_SECURITY_ARCHITECTURE.md — Security roadmap
• 🔧 CI/CD Security: WORKFLOWS.md — Pipeline security controls

📚 Related Documents

🔐 Security & Architecture

• 🛡️ Security Architecture — System security design
• 🎯 Threat Model — Comprehensive threat analysis
• 🔮 Future Security Architecture — Security roadmap
• 🏗️ Architecture — System architecture (C4 models)
• 🔧 Workflows — CI/CD pipeline documentation

📋 Project Governance

• 🤝 Contributing Guidelines — Secure contribution process
• 📜 Code of Conduct — Community standards
• 📋 README — Project overview and classification

🛡️ ISMS Policies (Hack23 AB)

• 🔐 Information Security Policy
• 🔍 Vulnerability Management
• 🚨 Incident Response Plan
• 🛠️ Secure Development Policy

📋 Document Control:
✅ Approved by: James Pether Sörling, CEO
📤 Distribution: Public
🏷️ Classification:
📅 Effective Date: 2026-02-20
⏰ Next Review: 2026-05-20
🎯 Framework Compliance:

🌐 IMF Integration — Security Disclosure Note

Effective: 2026-04-24 · Authoritative hub: analysis/imf/README.md · analysis/imf/agentic-integration.md · analysis/imf/indicators-inventory.json · analysis/imf/data-dictionary.md · .github/aw/ECONOMIC_DATA_CONTRACT.md

IMF data scope

Riksdagsmonitor consumes public macro/fiscal/monetary statistics from the IMF Datamapper REST API (www.imf.org/external/datamapper/api/v1, unauthenticated) and the IMF SDMX 3.0 endpoint (api.imf.org/external/sdmx/3.0, subscription-key authenticated via the Azure APIM Ocp-Apim-Subscription-Key header / IMF_SDMX_SUBSCRIPTION_KEY secret). The subscription key gates throttle/quota at the gateway; the underlying payloads remain public macro statistics. No personal data, no auth tokens are exchanged with the IMF; the subscription key is treated as a credential per the secrets-management policy. The IMF integration is therefore out of scope for GDPR DPIA but in scope for this security policy as a third-party dependency.

IMF-specific security posture

Reporting IMF-related vulnerabilities

If you discover a vulnerability in our IMF integration (e.g., cache integrity bypass, vintage substitution, egress allow-list breakout), follow the standard vulnerability-disclosure flow above. IMF data is public, so confidentiality breaches are not a concern; integrity and availability are the relevant attack surfaces.

IMF egress allow-list

Egress hosts (allow-list): www.imf.org (Datamapper REST · WEO/FM, unauthenticated), api.imf.org (SDMX 3.0 REST · IFS/BOP/DOTS/GFS/PCPS/ER/MFS_IR/MFS_PR, subscription-key authenticated via the Azure APIM Ocp-Apim-Subscription-Key header / IMF_SDMX_SUBSCRIPTION_KEY secret). Both HTTPS-only; payloads are public macro statistics with no PII.

Canonical rule. Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See ECONOMIC_DATA_CONTRACT.md v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).

🔗 Hack23 Ecosystem

🗳️ Empower citizens · 🔍 Strengthen democratic accountability · 🕵️ Illuminate the political process

_{© 2008–2026 Hack23 AB (Org.nr 559534-7807) · Maintainer: James Pether Sörling, CISSP CISM}