Okojo is a public research prototype — an agentic AI co-pilot for financial-crime investigations, built on fully synthetic and public data. It is not a production system and is not deployed against any real customer, ledger, or investigation. All scenario data is generated by a seeded, deterministic generator (scripts/generate_scenario.py); all reference data is public. No real person, address, document, or account ever enters the repository. See the README and docs/DECISIONS.md for the full data posture.

Because the data is synthetic and the outputs are proposal-only (a human reviews, decides, and files — nothing is sent or executed), the practical risk surface is the software itself: the library code and the Streamlit demo.

This is a solo research build under active development. Security fixes are applied to the latest release and the main branch only; earlier commits and tags are not maintained. There is no long-term-support commitment.

Please report suspected vulnerabilities privately, not in a public issue.

Use GitHub's private vulnerability reporting: on the repository page, open the Security tab and choose Report a vulnerability. This opens a private advisory visible only to the maintainer.

Please include:

• a description of the issue and its impact,
• the affected file(s) or component,
• and steps to reproduce, if you have them.

You can expect an initial acknowledgment within a reasonable time for a solo-maintained project. If a report is confirmed, a fix will be prepared on main and disclosed through a GitHub Security Advisory once addressed.

• The application and library code in this repository (src/, app/, scripts/).
• The dependency set pinned in requirements.txt.

• The synthetic scenario data and evaluation answer key — they are generated, contain no real information, and any "finding" they encode is by design.
• The prototype's modeling choices and calibrated-language conventions, which are documented design decisions rather than defects.
• Third-party services used only to host the demo.

Okojo's tamper-evident, append-only audit trail is a core feature, not a security afterthought. If you find a way to make a hash-chained record verify when it should not, that is exactly the kind of report this policy is for.