This policy covers the Arbor codebase and its umbrella libraries. Security is a core design principle of Arbor — the capability-based security kernel, taint tracking, and zero-trust architecture are central to the project.

If you discover a security vulnerability, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.

Instead, please use GitHub Security Advisories to report vulnerabilities privately.

• Description of the vulnerability
• Steps to reproduce
• Affected libraries or components
• Potential impact assessment
• Suggested fix (if you have one)

• Acknowledgment within 72 hours
• An assessment of severity and affected versions
• A fix timeline based on severity
• Credit in the fix commit (unless you prefer otherwise)

Arbor is currently in active development and pre-release. Security fixes will be applied to the main branch.