The Pavona Project takes security and security disclosures seriously.
If you believe you have found, or been made aware of, a critical security vulnerability in the Pavona Project that is not yet known, please send mail to security-disclosures@pavona.org. This mailing list is monitored by a small group of individuals on the Pavona security working group. Please do not include sensitive information, if you can avoid it, but do try to describe the outline of the issue. We understand that this may be challenging, and on balance the security of the design takes precedence over the need for discretion.
Security vulnerabilities are very diverse and threats can evolve quickly, so this policy only describes a general overview of the vulnerability reporting process. Reporters submitting high-quality disclosures will be contacted promptly to describe the vulnerability (and exchange PGP encryption keys if the criticality is deemed high enough). In collaboration with the reporter, the Pavona security working group will notify key partners and vendors of the vulnerability. The security working group will also work with the reporter to set the timeline for public disclosure (and acknowledgment, if desired).