This repository contains the VIDIMUS specification, not an implementation. It is still a working draft.

• A gap or ambiguity in a security requirement (for example in 05-security-requirements.md): open a normal issue using the "Gap in a security requirement" template. Public discussion is welcome.
• A vulnerability in an implementation of this specification: report it to the maintainers of that implementation. For the reference implementation (vidimus-core, not yet public) see its own SECURITY.md.
• An attack that works against a conformant implementation because of how the specification is written, or anything you would rather not discuss publicly before it is triaged: report privately, see below.

Write to info@favus.org. An encrypted report is possible with the GPG key 3312E2E9. Please do not open a public issue for these reports before they have been triaged.

Best effort, no SLA yet. This is a one-person-maintained draft at an early stage; the policy will be revised when the specification and its implementations have real users.