Re: Interested in contributing — privacy/security angle

[Jarek Potiuk <ja...@potiuk.com>]

Hi Mohit,

First — apologies. That thread went sideways: Adam's reply was meant for the
Fineract list, so the links you got were for a different project entirely,
and then my own reply was two links and a typo of your name :( .

You asked a clear question and didn't really get an answer. Let me fix that.

The honest answer to "is there a starting point for someone coming from the
AI-security/privacy side" is: not a written one. We have a contributor guide
aimed at maintainer tooling and no path aimed at your angle. That's a gap,
and given your background you're arguably the right person to shape it rather
than follow it.

What we do have is a real map, and I think it's the best entry point:

  https://magpie.apache.org/docs/security/threat-model/

Skip to "Residual risk and accepted gaps" near the end. It lists eleven gaps
we knowingly accepted at v1, each with the trigger that would force a
re-evaluation. It's a deliberately honest document — those are unsolved
problems, written down as unsolved. Three of them look like your work:

1. Per-skill redactor wiring is partial (gap 1). We ship the redactor, but
   the contract describes *what* it does, not *which* skills invoke it at
   which step. v1.1 is supposed to ship the per-skill wiring and nobody is
   on it. This is closest to your training-data-governance background.

2. Skill-scope discipline is convention, not enforcement (gap 9). Nothing at
   runtime stops an injected prompt from making the agent behave as a
   different skill mid-run. Related: cross-skill threat X1, prompt injection
   chained across skills. This is the one I'd most like an outside expert to
   attack rather than review.

3. Quarterly red-team testing is not scheduled (gap 5). The document commits
   to a re-audit before v1.1 ships, and we're heading into 0.2.0, so this is
   genuinely due rather than hypothetical. If red-teaming an agentic system is
   something you'd enjoy, this is unclaimed and time-relevant.

On reviewing the security posture of the triage/PR workflows — yes, please.
The threat model has a standing rule that every new agentic drafting skill
must add a STRIDE row to its skill family, and a skill without one shouldn't
pass review. That rule is only as good as the people checking it, and right
now there aren't many. André wrote the threat model and has been less
available lately, so there's real room to take ownership here rather than
just comment from the sidelines.

If you'd rather start smaller to get a feel for the repo, issue #954 —
narrowing empty exception handlers in the Fossil adapter — is small and
self-contained. But I'd rather not steer you to busywork: the three gaps
above are where you'd have most impact, and none of them are blocked on
anyone.

Happy to answer questions on-list or point you at whichever of these
interests you most.

Thanks for the offer, and sorry again for the runaround.

J.