update documentation

CODE_OF_CONDUCT.md

@@ -0,0 +1,160 @@
+# Code of Conduct
+
+## 1. Purpose
+
+This Code of Conduct establishes standards of behavior to ensure a professional,
+inclusive, and respectful environment for all contributors, maintainers, and users
+of the Bastionguard project.
+
+The project is committed to maintaining a safe, collaborative, and high-integrity
+community focused on defensive cybersecurity and ethical development.
+
+---
+
+## 2. Scope
+
+This Code of Conduct applies to all project spaces, including but not limited to:
+
+- Source code repositories
+- Issue trackers
+- Pull requests and code reviews
+- Discussion forums and chat platforms
+- Mailing lists and social media channels
+- Events and public communications related to the project
+
+It applies to all participants, including maintainers, contributors, users,
+and external collaborators.
+
+---
+
+## 3. Core Values
+
+Participants are expected to uphold the following principles:
+
+- Professionalism and integrity
+- Technical excellence and accountability
+- Respect for diverse perspectives
+- Transparency in decision-making
+- Responsible security practices
+- Ethical use of software
+
+---
+
+## 4. Expected Behavior
+
+All participants must:
+
+- Communicate respectfully and constructively
+- Provide clear, factual, and technically sound feedback
+- Accept constructive criticism in good faith
+- Follow secure coding practices
+- Respect intellectual property and licensing terms
+- Report security issues responsibly
+- Avoid conflicts of interest
+- Act in the best interest of the project and its users
+
+---
+
+## 5. Unacceptable Behavior
+
+The following behaviors are strictly prohibited:
+
+- Harassment, discrimination, or hate speech of any kind
+- Personal attacks, insults, or derogatory comments
+- Trolling, intimidation, or deliberate disruption
+- Publishing private or confidential information
+- Impersonation or misrepresentation
+- Promotion or facilitation of illegal activities
+- Development or promotion of offensive security tools
+  intended for malicious use
+- Knowingly introducing vulnerabilities or backdoors
+- Circumventing security controls without authorization
+- Abuse of project infrastructure or resources
+
+---
+
+## 6. Security and Responsible Disclosure
+
+Security vulnerabilities must be reported privately and responsibly.
+
+Participants must not publicly disclose security flaws before
+maintainers have had reasonable time to assess and remediate them.
+
+Unauthorized exploitation of vulnerabilities is prohibited.
+
+---
+
+## 7. Enforcement
+
+Project maintainers are responsible for enforcing this Code of Conduct.
+
+They may take any action deemed appropriate, including but not limited to:
+
+- Warning
+- Temporary suspension
+- Permanent ban
+- Rejection or removal of contributions
+- Revocation of contributor privileges
+- Legal action, where applicable
+
+Enforcement decisions will be made in good faith and documented
+when appropriate.
+
+---
+
+## 8. Reporting Violations
+
+Violations should be reported to the project maintainers through
+a designated private channel.
+
+Reports must include:
+
+- Description of the incident
+- Relevant evidence
+- Dates and locations
+- Involved parties
+
+All reports will be handled confidentially.
+
+Retaliation against reporters is strictly prohibited.
+
+---
+
+## 9. Governance and Appeals
+
+Participants may request a review of enforcement actions.
+
+Appeals must be submitted in writing and will be evaluated
+by the core maintainer team.
+
+Decisions following review are final.
+
+---
+
+## 10. Legal and Compliance
+
+All participants must comply with:
+
+- Applicable laws and regulations
+- Export control and sanctions laws
+- Data protection and privacy regulations
+- Project licensing terms (GPLv3)
+- Trademark usage guidelines
+
+Non-compliance may result in immediate removal from the project.
+
+---
+
+## 11. Amendments
+
+This Code of Conduct may be updated by project maintainers
+to reflect legal, technical, or community changes.
+
+Updates will be publicly documented.
+
+---
+
+## 12. Acknowledgment
+
+By participating in the Bastionguard project,
+you agree to abide by this Code of Conduct.

CONTRIBUTING.md

@@ -0,0 +1,150 @@
+# Contributing Guidelines
+
+Thank you for your interest in contributing to BastionGuard.
+
+This document defines the rules and procedures required to ensure
+high standards of quality, security, and consistency within the project.
+
+---
+
+## General Requirements
+
+All contributors must:
+
+- Comply with the Code of Conduct
+- Accept the GPLv3 license
+- Follow the Security Policy
+- Respect this document
+
+Contributions that do not meet these requirements
+may be rejected without further notice.
+
+---
+
+## Types of Contributions
+
+The following types of contributions are welcome:
+
+- Bug fixes
+- Performance improvements
+- Approved new features
+- Documentation enhancements
+- Automated tests
+- Security reviews and audits
+
+The following contributions are not accepted:
+
+- Offensive or malicious functionality
+- Code intended for illegal activities
+- Security bypass mechanisms
+- Violations of third-party rights
+- Obfuscated or intentionally misleading code
+
+---
+
+## Contribution Process
+
+### 1. Issue Reporting
+
+Before submitting major changes, contributors should:
+
+- Search for existing issues
+- Open a new issue describing the proposal
+- Wait for maintainer feedback when required
+
+---
+
+### 2. Fork and Branch
+
+Contributors must:
+
+- Fork the official repository
+- Create a dedicated branch for each change
+- Use descriptive branch names
+
+Example:
+
+
+---
+
+### 3. Development Standards
+
+All code contributions must:
+
+- Follow the project's coding style
+- Include appropriate documentation
+- Provide unit and integration tests where applicable
+- Avoid introducing breaking changes without approval
+- Maintain backward compatibility when possible
+
+---
+
+### 4. Security Requirements
+
+Contributors must:
+
+- Follow secure coding practices
+- Avoid hardcoded credentials or secrets
+- Prevent introduction of known vulnerabilities
+- Report discovered security issues privately
+
+Security-related changes may be subject to additional review.
+
+---
+
+### 5. Commit and Pull Request Rules
+
+Commits must:
+
+- Be atomic and focused
+- Include clear and descriptive messages
+- Reference relevant issues
+
+Pull Requests must:
+
+- Describe the purpose and scope of changes
+- Pass all automated checks
+- Address reviewer feedback
+- Not include unrelated modifications
+
+---
+
+### 6. Review and Approval
+
+All contributions are subject to review by maintainers.
+
+Approval requires:
+
+- Technical correctness
+- Security compliance
+- Alignment with project goals
+- Documentation completeness
+
+Maintainers reserve the right to request changes or reject submissions.
+
+---
+
+### 7. Licensing
+
+By submitting a contribution, you confirm that:
+
+- You have the right to submit the code
+- Your contribution is licensed under GPLv3
+- You grant the project the right to redistribute it
+
+Contributions violating licensing terms will be rejected.
+
+---
+
+## Code of Conduct
+
+All contributors must follow the Code of Conduct.
+Violations may result in suspension or permanent exclusion.
+
+---
+
+## Contact
+
+For questions related to contributions:
+
+info@bastionguard.eu

GOVERNANCE.md

@@ -0,0 +1,140 @@
+# Project Governance
+
+This document defines the governance model for the BastionGuard project.
+
+It establishes roles, responsibilities, and decision-making processes
+to ensure transparency, accountability, and long-term sustainability.
+
+---
+
+## Project Structure
+
+The project is governed by the Core Maintainer Team.
+
+The Core Maintainers are responsible for:
+
+- Defining project direction
+- Managing releases
+- Reviewing and approving contributions
+- Enforcing policies
+- Handling security incidents
+- Protecting the project trademark
+
+---
+
+## Roles
+
+### Core Maintainers
+
+Core Maintainers:
+
+- Have full write access to the repository
+- Approve major changes and releases
+- Resolve disputes
+- Represent the project publicly
+
+Appointment is based on:
+
+- Technical merit
+- Long-term contribution
+- Security awareness
+- Community conduct
+
+---
+
+### Maintainers
+
+Maintainers:
+
+- Review pull requests
+- Manage specific modules
+- Support contributors
+- Report to Core Maintainers
+
+Maintainers are appointed by the Core Maintainer Team.
+
+---
+
+### Contributors
+
+Contributors:
+
+- Submit code, documentation, or reports
+- Participate in discussions
+- Follow project policies
+
+No special privileges are granted by default.
+
+---
+
+## Decision-Making Process
+
+### Technical Decisions
+
+- Minor changes: Maintainer approval
+- Major changes: Core Maintainer review
+- Architectural changes: Formal proposal and consensus
+
+Consensus is preferred. If consensus cannot be reached,
+Core Maintainers have final authority.
+
+---
+
+### Policy Decisions
+
+Changes to governance, licensing, or policies require
+approval by the Core Maintainer Team.
+
+---
+
+## Release Management
+
+Releases are managed by Core Maintainers.
+
+Each release must:
+
+- Pass security audits
+- Meet quality standards
+- Include documentation
+- Be cryptographically signed when applicable
+
+---
+
+## Conflict Resolution
+
+Disputes are handled according to the Code of Conduct.
+
+Unresolved conflicts are escalated to Core Maintainers.
+
+Their decision is final.
+
+---
+
+## Security Governance
+
+All security-related matters are coordinated
+through the Security Policy.
+
+The Core Maintainers oversee:
+
+- Vulnerability handling
+- Incident response
+- Disclosure coordination
+
+---
+
+## Trademark Governance
+
+Use of the BastionGuard trademark is governed
+by the Trademark Policy.
+
+Unauthorized use may result in legal action.
+
+---
+
+## Amendments
+
+This governance model may be updated
+by the Core Maintainer Team.
+
+All changes will be documented publicly.

README.md

@@ -54,4 +54,4 @@ https://bastionguard.eu/issues
 
 ## Contact
 
-info@bastionguard.it
+info@bastionguard.eu

ROADMAP.md

@@ -0,0 +1,26 @@
+#  Roadmap – Email Security Module (Phase 1)
+
+## Email Threat Detection (ClamAV Integration)
+
+- Integration with ClamAV via `clamdscan`
+- Full MIME message scanning
+- Attachment inspection and analysis
+- Malware and phishing signature detection
+- Quarantine and isolation management
+- Scan result normalization
+- Fail-safe handling and error management
+- Configurable timeouts and resource limits
+- Logging and audit trail for compliance
+
+---
+
+#  Future Phases (Optional – Phase 2/3)
+
+## Advanced Email Protection
+
+- SPF / DKIM / DMARC validation
+- URL and domain reputation analysis
+- Heuristic-based phishing detection
+- Custom rule engine
+- SIEM / SOC integration
+- Centralized reporting dashboard

SECURITY.md

@@ -2,11 +2,98 @@
 
 ## Reporting Vulnerabilities
 
-Please report security issues **only if the encryption key or security mechanisms have been bypassed or compromised**.
+The Bastionguard project takes security issues seriously and is committed
+to responsible vulnerability handling.
 
-Contact:
+We encourage responsible disclosure of any security weakness that may
+impact the confidentiality, integrity, or availability of the system.
 
-- **Email:** info@bastionguard.it  
+This includes, but is not limited to:
+
+- Cryptographic weaknesses or key compromise
+- Authentication or authorization bypass
+- Remote code execution
+- Privilege escalation
+- Data leakage
+- Denial of Service vulnerabilities
+- Insecure default configurations
+
+---
+
+## Reporting Process
+
+Security issues must be reported privately and must not be disclosed
+publicly before a fix or mitigation is available.
+
+Please contact the security team using one of the following channels:
+
+- **Email:** info@bastionguard.eu  
 - **PGP Fingerprint:** E33B 4BC4 CAC6 FA6F 1CCA 2397 68D0 8974 A276 CF8A  
 
-Encrypted reports are preferred. Reports that do not demonstrate a verified bypass of cryptographic protections may not be considered.
+Encrypted communication is strongly preferred.
+
+---
+
+## Report Requirements
+
+To ensure efficient analysis, reports should include:
+
+- A detailed description of the vulnerability
+- Affected versions and components
+- Steps to reproduce the issue
+- Proof of concept, when available
+- Potential impact assessment
+
+Incomplete or unverifiable reports may not be prioritized.
+
+---
+
+## Responsible Disclosure
+
+Reporters are expected to:
+
+- Allow reasonable time for investigation and remediation
+- Avoid exploiting the vulnerability beyond proof of concept
+- Refrain from public disclosure until coordinated with maintainers
+
+The project commits to:
+
+- Acknowledge valid reports in a timely manner
+- Provide status updates when appropriate
+- Credit reporters, upon request
+
+---
+
+## Legal Safe Harbor
+
+The Bastionguard project considers security research conducted in good faith
+and in accordance with this policy to be authorized.
+
+We will not pursue legal action against researchers who:
+
+- Act in good faith
+- Avoid privacy violations and service disruption
+- Respect this disclosure process
+- Do not exploit vulnerabilities for personal gain
+
+---
+
+## Scope
+
+This policy applies to:
+
+- Core platform components
+- Official plugins and extensions
+- Deployment scripts and configuration templates
+- Official documentation and tooling
+
+Third-party integrations are excluded unless explicitly stated.
+
+---
+
+## Policy Updates
+
+This Security Policy may be updated to reflect technical,
+legal, or operational changes.
+
+All updates will be published in this repository.