Responsible Disclosure Policy

Purpose

This policy defines how security, safety, and correctness issues should be responsibly disclosed to PlainSight Lab.

Its purpose is to:

• reduce harm,
• preserve system integrity,
• and enable correction before exploitation.

This policy is not a marketing instrument. It exists to support correctness under adversarial conditions.

Scope

This policy applies to disclosures related to:

• canonical specifications stewarded by PlainSight Lab,
• derivative entities operating under its authority,
• governance mechanisms or invariants,
• and systems whose failure could cause material harm.

What to Disclose

Responsible disclosure includes, but is not limited to:

• security vulnerabilities,
• invariant violations,
• governance bypasses,
• exploit paths,
• ambiguity that materially increases correction cost,
• or failures that enable harm propagation.

If uncertain, disclosure is preferred.

How to Disclose

Disclosures should be made privately and in good faith.

The recommended method is:

• direct contact via security@plainsightlab.com

Disclosures should include:

• a clear description of the issue,
• affected components or documents,
• reproduction steps where applicable,
• and any relevant supporting material.

Anonymous disclosure is permitted.

Handling and Response

PlainSight Lab will:

• acknowledge receipt when feasible,
• evaluate disclosures based on severity and correction cost, and
• prioritize issues that affect invariants or enable exploitation.

Response timelines are not guaranteed. Correctness takes precedence over speed.

Coordinated Disclosure

Public disclosure prior to remediation may materially increase harm.

PlainSight Lab requests coordinated disclosure where feasible and reserves the right to delay public acknowledgement until:

• correction is possible,
• mitigations are in place,
• or exploitation risk is reduced.

This request is based on harm minimization, not secrecy.

Safe Harbor

Good-faith disclosures made in accordance with this policy will not be treated as hostile acts.

Disclosure does not grant authority, ownership, or influence.

Refusal and Non-Engagement

PlainSight Lab may decline to engage with disclosures that:

• are made in bad faith,
• are primarily promotional,
• or attempt to leverage disclosure for control, payment, or influence.

Refusal does not invalidate the underlying issue.

Closing

Responsible disclosure is a governance act.

It exists to preserve correctness before correction becomes costly or impossible.