Security policy — preparation draft

We are preparing for an eventual open source release. This local draft does not announce a public security program.

Private disclosure

Please send suspected vulnerabilities to hello@omegacompute.com. A dedicated security mailbox has not been verified, so do not rely on security@omegacompute.com. Mailbox monitoring and an escalation owner must be confirmed before launch.

Do not disclose vulnerabilities in public issues, discussions, or pull requests. Include the affected component and version or commit, impact, minimal reproduction steps, and redacted supporting evidence. Never email passwords, tokens, private keys, personal data, or live exploit payloads. Ask for a secure transfer method if sensitive evidence is necessary.

Test only systems you own or have explicit authorization to assess. Do not access other users' workloads, interrupt service, move funds, or perform destructive tests. This policy does not confer testing authorization or legal safe harbor.

Supported versions

TBD. No supported-version matrix or response-time commitment has been approved. Before launch, maintainers must name supported releases, triage owners, and a disclosure-coordination process. Coordinate publication with maintainers so fixes can be prepared without exposing users.

There is no announced bug bounty or reward promise. Private vulnerability reporting through GitHub should be enabled per public repository at launch if available and staffed.