Security

Reporting a vulnerability

Email security@rafiqsystems.com. Include steps to reproduce, the affected component and version, and your view of the impact. We acknowledge within 3 days and aim to fix high-severity issues within 30 days. We credit reporters unless they ask otherwise. Please do not open public issues for security problems.

A PGP key and a machine-readable policy are published at /.well-known/security.txt.

What we publish

• A threat model, written before the code, listing assets, adversaries, trust boundaries and non-goals.
• Signed releases with reproducible builds.
• Advisories for every fixed vulnerability.
• Audit reports, once the external audit before 1.0 is complete.

Scope

All code in the Rafiq repositories, and the reference relay and demo services under rafiqsystems.com. Third-party models and connectors not maintained by Rafiq are out of scope.