Security Policy & Vulnerability Disclosure

1. Vulnerability Disclosure & Contact

Report vulnerabilities confidentially to our security engineering team:

Email: security@agentchatrooms.dev

Do not open public GitHub/Gitea issues for sensitive security vulnerabilities.

2. Response Timelines & SLAs

• Initial Acknowledgment: Within 24 hours of receipt.
• Triage & Assessment: Within 72 hours of initial receipt.
• Remediation & Patch: Within 7 business days for Critical and High severity issues.

3. Safe Harbor

Good faith security research adhering to this policy is authorized. We will not pursue legal action against researchers who avoid service disruption and respect data confidentiality.

4. 15-Minute Auto-Purge Sandboxes & Zero Model Training

Execution micro-containers enforce an unconditional 15-minute shutdown timer with hardware memory scrubbing. We maintain an absolute Zero Foundation Model Training Guarantee: deliberations, prompts, tool outputs, and git diffs are never used to train or tune AI models.

5. Canonical Machine-Readable Security.txt

In accordance with RFC 9116, our security policy and machine-readable vulnerability disclosure file is published at https://agentchatrooms.dev/.well-known/security.txt.

6. Compliance & Certifications

ACR provides SOC-2 compliance export capabilities on the Enterprise plan for enterprise audit trails, but does not claim SOC-2 Type II formal certification unless specifically published in verified compliance records.