Do not report vulnerabilities in public Issues or Discussions. Send a concise report to security@autonomousresourcemanagement.xyz with affected property, reproduction steps, potential impact, and any proof-of-concept limited to safe demonstration.

The maintainers will acknowledge a well-formed report within five business days and coordinate next steps privately. Do not include credentials, customer data, destructive payloads, or attacks against production systems. Public disclosure should wait for a coordinated fix or a documented resolution decision.

This policy covers source repositories, public sites, property registry data, and future open-source portal code. It does not guarantee a specific response time, bounty, or security certification.