As a sovereign infrastructure for critical engineering ("Digital Commons"), RAISE takes security seriously. We encourage responsible disclosure of vulnerabilities.
Only the latest stable release is currently supported with security updates.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
Do NOT report security vulnerabilities through public GitHub issues.
If you believe you have found a security vulnerability in the RAISE core (JSON-DB, Traceability, AI Engine), please report it to our security team.
Please email security@raise.com with the subject [SECURITY] RAISE Vulnerability Report.
Include as much of the following information as possible:
- Type of issue (e.g., buffer overflow, SQL injection, XSS).
- Full paths of source file(s) related to the manifestation of the issue.
- The location of the affected source code (tag/branch/commit or direct URL).
- Any special configuration required to reproduce the issue.
- Step-by-step instructions to reproduce the issue.
- Proof-of-concept or exploit code (if possible).
- Impact of the issue, including how an attacker might exploit the issue.
We will acknowledge receipt of your vulnerability report within 48 hours and strive to send you regular updates about our progress.
Since RAISE is a Local-First application:
- We generally classify issues that leak data to external servers as Critical (Sovereignty Breach).
- Issues requiring physical access to the user's workstation are generally classified as Medium/Low, depending on the impact.
Thank you for helping us make sovereign engineering safe.