Security policy
This policy covers the Arkush services the maintainer operates. Arkush is maintained by one person, and the commitments below are written to be kept at that scale. If a deadline here slips, the report is not lost — send a reminder to the same address.
What this policy covers
In scope:
arkush.app.- The organization instances the maintainer operates.
- The API and the MCP endpoint those services expose.
Out of scope:
- How somebody else's instance is run: its host, its identity proxy, its configuration, and the data it holds. Report those to the operator of that instance. A defect in the Arkush software goes to the address below whoever runs the install — see Self-hosted installs.
- The identity-aware proxy in front of a deployment. Arkush trusts the authenticated-email header the proxy sets, which is the intended design. Report a defect in the proxy to the project that builds it.
- Google Cloud, BigQuery, and every other third-party service. Report those through the provider's own program.
- A finding that needs an account the reporter already controls to attack only that same account.
- A report produced by an automated scanner with no demonstrated impact.
Every fix ships as a new release tag on the current line. No version branch exists, and no fix is backported to an older tag. An install takes a fix by moving to the tag that carries it.
Report a vulnerability
Send the report to security@arkush.app.
Include in the report:
- What the problem is, in one or two sentences.
- The steps to reproduce the problem.
- Which service you tested against.
- The date and approximate time you tested.
- The impact you believe the problem has.
What happens next
| Step | Commitment |
|---|---|
| Acknowledgment of the report | 3 working days |
| First assessment | 10 working days |
| Fix for a critical problem | 14 days from the assessment |
| Fix for a high problem | 30 days from the assessment |
| Fix for a medium or low problem | 90 days from the assessment |
The assessment says three things: whether the report is accepted, what severity it gets, and when the fix is planned. If a report is not accepted, the reply says why.
The same table measures a published advisory in a dependency, counted from the day the maintainer learns of it. The fix is a release tag in every case, so one set of times covers the services the maintainer operates and every self-hosted install.
Self-hosted installs
An organization that runs its own install holds the host, the identity provider, the warehouse credential and the data. The maintainer holds none of them and has no route into the install.
Reporting. Send a defect in the Arkush software to security@arkush.app, whoever operates the install. Name the version from the Help panel instead of a hostname. The safe harbor below covers a customer's own team testing its own install.
Patches. The table above is the time from the assessment to a published release tag. Applying that tag is the operator's act: the maintainer cannot reach the install, and no update is pushed to it. The release note for a tag says what an operator meets at the update.
No backports. A fix lands on the current release line only. An install several versions behind takes the fixes between its tag and the current one by moving forward, and the boot refusals name each step it has to pass.
Support. Support is best effort. No response time is promised for a question that is not a security report, and no commitment exists to build anything a customer asks for. The deploy guide, the security overview and the changelog ride in the image, so an install can be run, updated, backed up and decommissioned without the maintainer.
Disclosure
Arkush uses coordinated disclosure:
- You report the problem privately.
- The fix reaches the affected services.
- The maintainer confirms to you that the fix is live, and agrees with you how you are credited.
Ninety days after the acknowledgment, you are free to publish, whatever state the fix is in. Tell the maintainer first as a courtesy.
Safe harbor
The maintainer will not pursue a reporter who:
- keeps the finding private until the fix is live or the ninety days pass,
- touches only data and accounts that belong to the reporter,
- stops at the point where the problem is demonstrated,
- does not degrade the service for other people, and
- does not read, change, or keep anybody else's data.
Arkush pays no bounty.