Invisra takes the security of our software and services seriously. This policy applies to every repository in the invisra organization that does not publish its own SECURITY.md.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Instead, report them by email to security@invisra.ai.

For sensitive reports, encrypt your message with our OpenPGP key:

• Key: https://assets.invisra.ai/keys/security-openpgp.asc
• Fingerprint: C472 E638 2DF7 FB4A E64F FB96 0FCB 0778 B7CC A454

Our canonical policy and key details are published at https://invisra.ai/security and https://invisra.ai/.well-known/security.txt (RFC 9116).

To help us triage quickly, please include as much of the following as you can:

• The affected repository, service, URL, or component and the version or commit.
• A description of the vulnerability and its potential impact.
• Steps to reproduce, proof-of-concept code, or a working exploit.
• Any relevant logs, screenshots, or configuration details.

• We will acknowledge your report and let you know the next steps.
• We will keep you informed as we investigate and work on a fix.
• We will credit you for the discovery once the issue is resolved, unless you prefer to remain anonymous.

Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and avoid accessing or modifying other users' data, degrading our services, or violating privacy while researching. We appreciate your good-faith effort to keep Invisra and its users safe.