DO NOT open a public issue for security vulnerabilities.

1. Email: security@aral-standard.org
2. Subject: [SECURITY] Brief description
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

1. Confirmation of receipt
2. Assessment of severity (CVSS score)
3. Regular updates on progress
4. Credit in security advisory (if desired)
5. Coordinated disclosure

In scope:

• ARAL specification vulnerabilities
• Reference implementation bugs
• JSON Schema validation bypasses
• Authentication/authorization flaws

Out of scope:

• Third-party implementations
• Social engineering
• Physical security
• Denial of service (unless critical)

We will not take legal action against researchers who:

• Act in good faith
• Avoid privacy violations
• Avoid data destruction
• Report promptly
• Allow reasonable time for fixes

When implementing ARAL:

1. Always validate against JSON schemas
2. Never trust L4 (Reasoning) output without L3 (Capabilities) verification
3. Implement circuit breakers (ARAL-L6-003)
4. Use secrets via vault references only (ARAL-S-080)
5. Log all security events (ARAL-S-090)

• Security Team: security@aral-standard.org
• PGP Key: [Available on request]

© 2026 IbIFACE