From 2b01faee7a68764808a09f868b2b68354e28b32b Mon Sep 17 00:00:00 2001 From: hudsonaikins-crown Date: Wed, 22 Jul 2026 14:10:47 -0700 Subject: [PATCH 1/2] fix(security): remove unowned package contact domains --- CODE_OF_CONDUCT.md | 4 +-- CONTRIBUTING.md | 2 +- docs/mint.json | 2 +- docs/openapi/authentication-schemes.yaml | 4 +-- docs/openapi/data-collection-apis.yaml | 4 +-- docs/openapi/data-models.yaml | 4 +-- docs/openapi/fix-protocol.yaml | 4 +-- docs/openapi/kalshi-trading-api.yaml | 4 +-- docs/openapi/websocket-api.yaml | 4 +-- pyproject.toml | 5 ++-- scripts/generate_openapi_specs.py | 2 +- tests/test_contact_security.py | 36 ++++++++++++++++++++++++ 12 files changed, 55 insertions(+), 20 deletions(-) create mode 100644 tests/test_contact_security.py diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 7c9bb7ac..1bdb35a3 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -27,7 +27,7 @@ Community leaders are responsible for clarifying and enforcing our standards of This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. ## Enforcement -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at contributors@neural-sdk.dev. All complaints will be reviewed and investigated promptly and fairly. +Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at hudson@intelip.co. All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident. @@ -42,4 +42,4 @@ Community leaders will follow these Community Impact Guidelines in determining t ## Attribution This Code of Conduct is adapted from the Contributor Covenant, version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html -For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq. \ No newline at end of file +For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 265a461e..87452716 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -104,4 +104,4 @@ The SDK documentation lives in `docs/` and uses Mintlify. When you update docs a - Documentation: https://neural-sdk.mintlify.app - Discussions: https://github.com/IntelIP/Neural/discussions -- Email: contributors@neural-sdk.dev +- Email: hudson@intelip.co diff --git a/docs/mint.json b/docs/mint.json index e4ac2996..93bc5bba 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -19,7 +19,7 @@ "topbarLinks": [ { "name": "Support", - "url": "mailto:support@neural-sdk.com" + "url": "mailto:hudson@intelip.co" } ], "topbarCtaButton": { diff --git a/docs/openapi/authentication-schemes.yaml b/docs/openapi/authentication-schemes.yaml index ed953d3f..d8a77912 100644 --- a/docs/openapi/authentication-schemes.yaml +++ b/docs/openapi/authentication-schemes.yaml @@ -30,7 +30,7 @@ info: version: 1.0.0 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural license: name: MIT @@ -495,4 +495,4 @@ tags: - name: Authorization description: Authorization flows and permissions - name: Security - description: Security best practices and error handling \ No newline at end of file + description: Security best practices and error handling diff --git a/docs/openapi/data-collection-apis.yaml b/docs/openapi/data-collection-apis.yaml index cdd9543a..af05c264 100644 --- a/docs/openapi/data-collection-apis.yaml +++ b/docs/openapi/data-collection-apis.yaml @@ -27,7 +27,7 @@ info: version: 1.0.0 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural license: name: MIT @@ -806,4 +806,4 @@ tags: - name: ESPN Sports Data description: Real-time sports scores and team information from ESPN API - name: Twitter API - description: Social media data and sentiment analysis from Twitter API \ No newline at end of file + description: Social media data and sentiment analysis from Twitter API diff --git a/docs/openapi/data-models.yaml b/docs/openapi/data-models.yaml index 43d84250..5dc0ccfe 100644 --- a/docs/openapi/data-models.yaml +++ b/docs/openapi/data-models.yaml @@ -25,7 +25,7 @@ info: version: 1.0.0 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural license: name: MIT @@ -1022,4 +1022,4 @@ components: ErrorCategory: type: string enum: [validation, authentication, authorization, rate_limit, server, network] - description: Error category enumeration \ No newline at end of file + description: Error category enumeration diff --git a/docs/openapi/fix-protocol.yaml b/docs/openapi/fix-protocol.yaml index 1a239aa9..8c6316ea 100644 --- a/docs/openapi/fix-protocol.yaml +++ b/docs/openapi/fix-protocol.yaml @@ -33,7 +33,7 @@ info: version: 5.0.2 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural license: name: MIT @@ -889,4 +889,4 @@ tags: - name: Market Data description: Real-time market data subscriptions and updates - name: System Messages - description: System-level messages and error handling \ No newline at end of file + description: System-level messages and error handling diff --git a/docs/openapi/kalshi-trading-api.yaml b/docs/openapi/kalshi-trading-api.yaml index 6f07b9ca..485c7ba8 100644 --- a/docs/openapi/kalshi-trading-api.yaml +++ b/docs/openapi/kalshi-trading-api.yaml @@ -18,7 +18,7 @@ info: version: 2.0.0 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural license: name: MIT @@ -922,4 +922,4 @@ tags: - name: Order Management description: Order creation, modification, and cancellation - name: Historical Data - description: Historical market data for analysis \ No newline at end of file + description: Historical market data for analysis diff --git a/docs/openapi/websocket-api.yaml b/docs/openapi/websocket-api.yaml index 74f8e519..86dbf4db 100644 --- a/docs/openapi/websocket-api.yaml +++ b/docs/openapi/websocket-api.yaml @@ -26,7 +26,7 @@ info: version: 2.0.0 contact: name: Neural SDK Support - email: support@neural-sdk.com + email: hudson@intelip.co url: https://github.com/IntelIP/Neural servers: @@ -615,4 +615,4 @@ tags: - name: Trading description: Order and position update channels - name: System - description: System messages and errors \ No newline at end of file + description: System messages and errors diff --git a/pyproject.toml b/pyproject.toml index b5d25885..e924aba7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -18,11 +18,10 @@ keywords = [ ] authors = [ { name = "Hudson Aikins", email = "hudson@intelip.co" }, - { name = "Neural Contributors", email = "contributors@neural-sdk.dev" } + { name = "Neural Contributors" } ] maintainers = [ - { name = "Advanced Intellectual Labs LLC", email = "hudson@intelip.co" }, - { name = "Neural Contributors", email = "contributors@neural-sdk.dev" } + { name = "Advanced Intellectual Labs LLC", email = "hudson@intelip.co" } ] classifiers = [ "Development Status :: 4 - Beta", diff --git a/scripts/generate_openapi_specs.py b/scripts/generate_openapi_specs.py index 89fa0d70..ff9a87af 100644 --- a/scripts/generate_openapi_specs.py +++ b/scripts/generate_openapi_specs.py @@ -19,7 +19,7 @@ def __init__(self, output_dir: Path = Path("docs/openapi")): "title": "Neural SDK API", "version": "0.3.0", "description": "REST API for Neural SDK trading and data collection functionality", - "contact": {"name": "Neural SDK Team", "email": "support@neural-sdk.com"}, + "contact": {"name": "Neural SDK Team", "email": "hudson@intelip.co"}, "license": { "name": "MIT", "url": "https://github.com/IntelIP/Neural/blob/main/LICENSE", diff --git a/tests/test_contact_security.py b/tests/test_contact_security.py new file mode 100644 index 00000000..67b4626b --- /dev/null +++ b/tests/test_contact_security.py @@ -0,0 +1,36 @@ +from pathlib import Path + +REPO_ROOT = Path(__file__).resolve().parents[1] +CONTACT_SURFACES = ( + "pyproject.toml", + "CONTRIBUTING.md", + "CODE_OF_CONDUCT.md", + "docs/mint.json", + "docs/openapi/authentication-schemes.yaml", + "docs/openapi/data-collection-apis.yaml", + "docs/openapi/data-models.yaml", + "docs/openapi/fix-protocol.yaml", + "docs/openapi/kalshi-trading-api.yaml", + "docs/openapi/websocket-api.yaml", + "scripts/generate_openapi_specs.py", +) +UNCONTROLLED_CONTACT_DOMAINS = ("neural-sdk.dev", "neural-sdk.com") + + +def test_public_contact_surfaces_do_not_use_uncontrolled_domains() -> None: + violations = [] + + for relative_path in CONTACT_SURFACES: + content = (REPO_ROOT / relative_path).read_text(encoding="utf-8") + for domain in UNCONTROLLED_CONTACT_DOMAINS: + if domain in content: + violations.append(f"{relative_path}: {domain}") + + assert not violations, "Uncontrolled contact domains found: " + ", ".join(violations) + + +def test_package_metadata_uses_accountable_maintainer_contact() -> None: + metadata = (REPO_ROOT / "pyproject.toml").read_text(encoding="utf-8") + + assert '{ name = "Hudson Aikins", email = "hudson@intelip.co" }' in metadata + assert '{ name = "Advanced Intellectual Labs LLC", email = "hudson@intelip.co" }' in metadata From 6ffb8dce65554ad08114854035dba72be1022167 Mon Sep 17 00:00:00 2001 From: hudsonaikins-crown Date: Mon, 27 Jul 2026 22:05:22 -0700 Subject: [PATCH 2/2] fix: keep blocked-domain fixtures out of artifacts --- tests/test_contact_security.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_contact_security.py b/tests/test_contact_security.py index 67b4626b..faf02b5d 100644 --- a/tests/test_contact_security.py +++ b/tests/test_contact_security.py @@ -14,7 +14,7 @@ "docs/openapi/websocket-api.yaml", "scripts/generate_openapi_specs.py", ) -UNCONTROLLED_CONTACT_DOMAINS = ("neural-sdk.dev", "neural-sdk.com") +UNCONTROLLED_CONTACT_DOMAINS = tuple("neural-sdk" + suffix for suffix in (".dev", ".com")) def test_public_contact_surfaces_do_not_use_uncontrolled_domains() -> None: