Vulnerability disclosure

How to report a security issue in Arc OS, what to expect from us, and the scope and safe harbor for good-faith research.

How to report

• Email [email protected]. One issue per report.
• Include what you found, where (URL, endpoint, or commit), the steps to reproduce it, the impact, and any proof of concept.
• Please do not disclose the issue publicly before we have fixed it.

What to expect from us

• We acknowledge your report within 5 business days.
• We give a first assessment (accepted, need more information, or out of scope) within 10 business days.
• We keep you updated through remediation and tell you when it is fixed.
• With your consent, we credit you once the fix is live.

Scope

In scope:

• arc-os.co and its subdomains, the Arc OS web app and API, and the arc CLI and its update channel.

Out of scope:

• Third-party services we build on (for example Anthropic, Cloudflare, GitHub): report those to the provider.
• Findings that require a compromised device, a rooted or jailbroken operating system, or physical access to someone's machine.
• Social engineering of our team or our users, spam, and volumetric denial of service.
• Automated-scanner output with no demonstrated, exploitable impact.

Safe harbor

We will not pursue or support legal action against you for security research conducted in good faith that follows this policy. If you:

• make a good-faith effort to avoid privacy violations, data destruction, and interruption or degradation of the service,
• only interact with accounts you own or have explicit permission to test,
• do not access, change, or keep other users' data beyond the minimum needed to demonstrate the issue, and
• give us a reasonable time to fix the issue before disclosing it publicly,

then we consider your research authorized, and we will work with you to resolve the issue quickly. If a third party brings legal action against you for activity that followed this policy, we will make this authorization known.

This is not a paid bug-bounty program. We do not currently offer monetary rewards.

Questions

Email [email protected]. See also the Security overview and security.txt at /.well-known/security.txt.