Security & Vulnerability Disclosure Policy

1. Overview & Commitment

Aetheron Engine Labs ("Aetheron") prioritizes the security, integrity, and operational resilience of its public infrastructure and systems. We recognize the role independent security researchers play in validating internet-facing services.

This Vulnerability Disclosure Policy ("VDP") defines the authorized scope of security research, submission procedures, safe harbor terms, and remediation workflows in alignment with ISO/IEC 29147.

2. Scope Boundaries

In-Scope Assets

Authorized security testing is strictly limited to the following public web properties:

• https://aetheronengine.com
• Public-facing static web pages, intake forms, and public DNS records directly operated by Aetheron Engine Labs.

Strictly Out-of-Scope Assets

Any system, network, or asset not explicitly listed above is strictly off-limits. Out-of-scope assets include, but are not limited to:

• Client, Partner, and Sovereign Networks: Any customer environments, operational deployments, private subnets, or air-gapped instances.
• Internal Research & Development Infrastructure: Non-public development, staging, simulation, and testing environments.
• Proprietary Software & Data: Pre-release software, compiled executables, restricted documentation, and non-public source repositories.
• Third-Party Infrastructure: Upstream network transit, DNS service providers, content delivery networks, and third-party communication services.

3. Prohibited Activities

The following activities are strictly prohibited and constitute a material violation of this policy:

• Denial of Service (DoS/DDoS), resource exhaustion, or traffic-flooding attacks.
• Social engineering, phishing, pretexting, or physical security attempts targeting personnel, contractors, or facilities.
• High-volume automated vulnerability scanning that degrades infrastructure performance.
• Accessing, downloading, modifying, deleting, or retaining data belonging to Aetheron, its personnel, or its partners.
• Attempting to reverse-engineer, decompile, or extract proprietary code or binaries.
• Introducing malicious payloads, lateral movement, or persisting remote access.

4. Researcher Protocols & Reporting

Researchers must act in good faith and adhere to the following reporting protocol:

1. Immediate Cessation: If sensitive or non-public data is inadvertently accessed, cease all activity immediately and notify Aetheron.
2. Zero Retention: Do not retain, export, copy, or share any data encountered during evaluation. Delete all local remnants immediately following verified delivery of the report.
3. Encrypted Submission: Transmit all vulnerability reports directly to security@aetheronengine.com. PGP public key available upon request for sensitive disclosures.

Required Report Contents:

• Clear summary and Common Weakness Enumeration (CWE) identifier.
• Step-by-step reproduction instructions or a benign, non-destructive proof-of-concept (PoC).
• Impact assessment detailing the specific risk to public-facing assets.
• Remediation guidance (optional).

5. Coordination & Remediation

Aetheron handles vulnerability reports according to a structured lifecycle:

• Acknowledgment: Within 48 hours of initial receipt.
• Validation & Triage: Within 5 business days of acknowledgment.
• Coordinated Disclosure: Researchers agree to maintain strict confidentiality and withhold public disclosure until an official fix has been deployed, or until a mutually agreed 90-day coordinated disclosure period has elapsed.

6. Safe Harbor

Aetheron considers research activities conducted strictly within the boundaries of this policy to be authorized and lawful.

For researchers acting in accordance with this VDP:

• Aetheron will not initiate or pursue civil or criminal legal action under the Canadian Criminal Code, the U.S. Computer Fraud and Abuse Act (CFAA), or equivalent cybercrime statutes.
• Aetheron will not characterize the research activity as unauthorized access or a malicious intrusion.
• If a third-party service provider initiates legal action against a researcher operating within these terms, Aetheron will confirm that the researcher acted in good faith under our authorized program.

Safe harbor protections do not apply to testing that impacts client environments, degrades availability, exfiltrates data, or violates applicable statutory laws.

7. Program Terms

• Recognition: Valid submissions may be formally credited on our Security Acknowledgments page, subject to researcher preference.
• Policy Type: This document governs authorized, coordinated vulnerability disclosures. It does not establish a monetary bug-bounty program.
• Security Metadata: Refer to our RFC 9116 specification at https://aetheronengine.com/.well-known/security.txt