From 72a705a2917a697fd9cbb1c220810aa8fc941955 Mon Sep 17 00:00:00 2001 From: Hanzo Dev Date: Mon, 18 May 2026 23:53:36 -0700 Subject: [PATCH] docs: canonical README opening + SECURITY.md (#4) * docs: canonical README opening per Hanzo OSS taxonomy * docs: add canonical SECURITY.md --- README.md | 41 +++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 17 ++++++++--------- 2 files changed, 49 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index a05898646..51b0a90a1 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,44 @@ +# o11y + +Metrics, traces, logs — the unified observability spine for the Hanzo platform. OpenTelemetry-native, OLAP-backed via Hanzo Datastore. + +[![Status](https://img.shields.io/badge/status-stable-green)]() +[![License](https://img.shields.io/badge/license-MIT-blue)]() + +## Quick start + +```bash +docker compose -f compose.yml up -d +``` + +Open `http://localhost:3301`. + +## What this is + +`o11y` is the unified APM / logs / traces / metrics surface every Hanzo service emits to. OpenTelemetry on the wire, Hanzo Datastore (OLAP column store) on disk. Multi-tenant by design — 309 `X-Org-Id` call sites — every panel scopes by org from the JWT. Sits behind `gateway` like every other Hanzo subsystem; eventually mounts under `hanzoai/cloud` per HIP-0106. + +## Specs + +Implements: +- HIP-0106 Unified Cloud Binary (o11y subsystem) + +## Architecture + +``` + instrumented app -> OTLP -> o11y collector + | + Hanzo Datastore (OLAP column store) + | + APM | logs | traces | metrics + | + queries scoped by X-Org-Id from JWT + | + dashboards | alerting | exceptions +``` + + +--- +

Hanzo O11y diff --git a/SECURITY.md b/SECURITY.md index de521b256..4f120b9f1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,18 +1,17 @@ # Security Policy -Hanzo O11y is looking forward to working with security researchers across the world to keep Hanzo O11y and our users safe. If you have found an issue in our systems/applications, please reach out to us. +## Reporting a vulnerability -## Supported Versions -We always recommend using the latest version of Hanzo O11y to ensure you get all security updates +Email security@hanzo.ai with details. Encrypt with our PGP key (fingerprint TBD). -## Reporting a Vulnerability +We respond within 48 hours. Critical issues receive same-day acknowledgment. -If you believe you have found a security vulnerability within Hanzo O11y, please let us know right away. We'll try and fix the problem as soon as possible. +## Scope -**Do not report vulnerabilities using public GitHub issues**. Instead, email with a detailed account of the issue. Please submit one issue per email, this helps us triage vulnerabilities. +This policy covers code in this repository. For the broader Hanzo platform threat model, see [hanzoai/HIPs](https://github.com/hanzoai/HIPs). -Once we've received your email we'll keep you updated as we fix the vulnerability. +## Sandbox boundary -## Thanks +`o11y` ingests telemetry from every Hanzo service, so every query path is scoped by the JWT-validated `X-Org-Id` header — no panel, alert, or query can cross an org boundary. Logs, traces, and metrics are stored on Hanzo Datastore with per-tenant retention, and sensitive headers / payload fields are redacted at ingest time. -Thank you for keeping Hanzo O11y and our users safe. 🙇 +For runtime sandbox guarantees, see HIP-0105 (in-process extension runtimes).