vault-family-core implements the cryptographic foundation of the VCAV protocol family. Security researchers who discover vulnerabilities are asked to disclose responsibly via GitHub Security Advisories rather than opening a public issue.
To report a vulnerability:
- Go to the Security tab of this repository.
- Click New draft security advisory.
- Describe the vulnerability, affected versions, and (if known) a minimal reproduction.
- Submit the draft — maintainers will respond within 5 business days.
The following components are in scope for security research:
- Ed25519 signing and verification (
receipt-core,message-envelope,afal-core) - Receipt generation and tamper detection (
receipt-core) - Canonicalization / RFC 8785 JCS implementation (
receipt-core::canonicalize) - IFC label algebra and policy evaluation (
ifc-engine) - AFAL wire types and signing (
afal-core) - JSON Schema validation (
verifier-core::schema_validator) - WASM verification surface (
verifier-wasm,ifc-wasm)
Out-of-scope: build tooling, CI configuration, documentation errors.
- Maintainers will acknowledge receipt within 5 business days.
- A fix will be prepared in a private fork and coordinated with the reporter before public disclosure.
- Credit will be given in the release notes unless the reporter requests anonymity.