# Security contact and vulnerability-reporting policy

**Policy version:** 1.0.0.

**Current intake contact:** unassigned. Do not claim a monitored security
channel until `ACTUAL-CONTACTS`, `ROLE-ASSIGNMENTS`, and
`SECURITY-POLICY-ACCEPTANCE` evidence is complete.

## Approved-policy template

Report suspected vulnerabilities privately through the executed agreement's
named security channel. Include affected candidate ID/version, component,
impact, reproduction steps that avoid real funds and personal data, and a safe
contact method. Do not include secrets, private keys, seed phrases, raw personal
data, or exploit live systems.

Vaultfire's assigned security contact will:

1. acknowledge receipt under the selected support/security tier;
2. preserve the original report and restrict access to need-to-know roles;
3. classify severity and activate incident escalation when exploitation or
   material exposure is plausible;
4. coordinate remediation, candidate rebinding, validation, and disclosure;
5. avoid requesting surveillance data as a condition of triage.

There is no bounty, safe-harbor promise, embargo period, or response-time
commitment until separately approved in writing. Researchers must not access
others' data, disrupt service, extort, move funds, retain unnecessary data, or
exceed written authorization. This policy does not waive legal rights and is
not legal advice.

Public disclosure timing must consider remediation availability, affected
parties, legal/notification duties, and coordinated disclosure terms. Only an
authorized spokesperson may make a public statement.
