docs: say who qualifies for private repository access

[aljo242]

"Downstream teams that have passed KYC" never said whether an exchange running the software qualifies, while the distribution rule says not to pass patch source to validators or node operators. A professional operator was on the wrong side of one of those.

Chain development teams and major exchange partners qualify, through KYC and directly from us. The redistribution rule is unchanged.

[greptile-apps]

Confidence Score: 4/5

[Low risk] Updates security policy documentation for private repository access.

The access-policy wording should be clarified before merging so both recipient groups are explicitly subject to KYC and production-use requirements.

Findings

1.  Access requirements may not apply ▶

Summary

The PR replaces the general “downstream teams” access category with chain development teams and major exchange partners. The new sentence does not clearly apply the existing KYC and production-use prerequisites to both groups.

_{Reviews (1) · Last reviewed commit: "docs: say who qualifies for private repo..."}

[greptile-apps]

Access requirements may not apply

The phrase “that have passed KYC and run the repository in production” follows only “major exchange partners.” An administrator could read this as granting chain development teams access without either requirement, allowing invitations to private patch repositories without the previously required KYC check. Make clear that both groups must meet both requirements.

Suggested change

	Access is granted to chain development teams and to major exchange partners that
	have passed KYC and run the repository in production. Each month's repositories
	Access is granted to chain development teams and major exchange partners only if
	each team has passed KYC and runs the repository in production. Each month's repositories

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!