OPERATIONAL SECURITY
Vulnerability Disclosure Policy
We take the security of autonomous software execution and deterministic policy layers with paramount seriousness.
How to Report a Vulnerability
If you discover a security vulnerability or exploit touching any Sonnev product (Gate, Sonnev infrastructure, or lab systems), please submit your finding immediately:
- Submit via our direct form: contact.sonnev.com/contact?topic=Security
- Email directly: security@sonnev.com
- View RFC 9116 machine-readable specification: /.well-known/security.txt
Program Scope
In-scope systems include:
- Deterministic policy engine bypasses on Gate (`gate.sonnev.com`)
- Tamper-evident audit chain corruption or hash collision vulnerabilities
- Unauthorized permission escalation or budget ceiling evasion
- Authentication and cryptographic key handling flaws
Guidelines & Safe Harbor
We commit not to initiate legal action against researchers who:
- Make a good-faith effort to avoid privacy violations and destruction of production data.
- Give our engineering team reasonable time to remediate the vulnerability before public disclosure.
- Do not engage in denial-of-service (DoS) or automated brute-force testing against production systems.
Security Advisory Stub
TODO(afx): Add PGP public key fingerprint and cryptographic verification keys.