Vulnerability disclosure policy

Questionnaire-formatted version of SECURITY.md. If the two ever disagree, SECURITY.md is the source of truth — this document exists so the same policy can be quoted in the format a vendor security review usually asks for.

Do you have a vulnerability disclosure / responsible disclosure policy?

Yes. See SECURITY.md.

How can a researcher report a vulnerability?

Email security@zybuu.com.

Fallback address (currently the one monitored day to day, reaching the same person): support@zybuu.com.

There is no bug bounty program and no bounty payment. This is disclosure handling, not a paid program.

What acknowledgement should a reporter expect, and how fast?

Acknowledgement within 3 business days of the report.

What is the remediation SLA?

For high-severity findings: a fix or a documented mitigation plan within 30 days of acknowledgement. Lower-severity findings are triaged and addressed but do not carry a fixed number — the reporter is told the plan rather than left to guess. This is a one-person maintainer team; see docs/trust/README.md and docs/trust/incident-response.md for what that means for response capacity.

Is there a safe harbor for good-faith security research?

Yes. Research conducted within the scope below, that avoids privacy violations and service disruption, and that is reported before public disclosure, will not be pursued legally. Full text in SECURITY.md's "Safe harbor" section. This extends the same principle docs/access-policy.md already states for the hosted console: "Security research is welcome; do it against your own install and tell us what you find."

Scope

In scope:

• The harness (cmd/, internal/, sdk/)
• The web console (abhed serve, and the hosted instance at abhed.zybuu.com)
• Deploy scripts (deploy/)
• The zybuu.com Cloudflare Pages Functions (web/zybuu/functions/)

Out of scope:

• The model's own output or behavior (Abhed is model-agnostic by construction — see docs/vision.md)
• Third-party providers Abhed is configured to talk to (identity providers, model endpoints, Cloudflare, Resend) — report those to the provider directly
• Findings that require a documented misconfiguration the project explicitly warns against (for example, disabling the sandbox on a multi-user deployment — see docs/trust/security-posture.md)

Do you publish security advisories, and where?

Not yet — there is no public advisory database or CVE program for Abhed today. Fixes ship as ordinary commits with a description of what was wrong, following the same evidence-discipline convention README.md documents for the rest of the project (found bugs are written up, not quietly patched).

Disclosure timeline commitment

We ask reporters for reasonable time to remediate before public disclosure. In turn, once a fix ships, we credit the reporter (if they want credit) in the commit or changelog entry.

Changelog

_No disclosed vulnerabilities have been published against this policy yet._ This section will list, per entry: date reported, date fixed, severity, and a link to the fix commit, once there is a first one to list.