# OctetKeep Security Vulnerability Disclosure Policy

**Effective date:** 2026-08-16

Elementary Inc. welcomes good-faith security research intended to improve OctetKeep.

## Reporting

Security vulnerabilities should be reported through the dedicated security contact published on the OctetKeep website. Do not include unnecessary customer forensic artifacts, credentials or other sensitive data in an initial report.

## What to include

Please provide the affected version, product surface, reproduction steps, security impact and any suggested mitigation. Encrypted reporting may be used where supported by the published security channel.

## Good-faith research

Research that is conducted lawfully, avoids unnecessary access or disruption, and gives Elementary Inc. a reasonable opportunity to investigate is treated as coordinated vulnerability disclosure activity.

## Handling

Reports are triaged, assigned a severity and tracked through the security process. Where applicable, actively exploited vulnerabilities and severe security incidents will be handled and reported under the Cyber Resilience Act and other applicable requirements.

## Confidentiality

Elementary Inc. will limit access to security reports to people who need the information to investigate, remediate or meet legal obligations.

## Updates

This policy may be updated as the security and regulatory program matures. The current version is the version published on the OctetKeep website.