If you discover a security vulnerability in the VBR™ specification, the reference signer, the reference verifier, or any aspect of the open standard published in this repository, we ask that you report it responsibly.
Please do not open a public GitHub issue for security vulnerabilities.
Instead, email trust@laiyr.ai with the following information:
- A description of the vulnerability
- Steps to reproduce, if applicable
- The version of the specification or reference implementation affected
- Your assessment of severity (low, medium, high, critical)
- Whether you are willing to be credited publicly when the issue is resolved
We will acknowledge receipt of your report within 3 business days and provide an initial assessment within 7 business days.
This security policy covers:
- The VBR™ JSON Schema (
vbr.schema.json) - The publication path conventions (
/.well-known/brand-assertions.json,/.well-known/brand-key) - The signing algorithm specification (ECDSA P-256, SHA-256, RFC 8785 JCS canonicalization)
- The verification model documented in
README.md - The reference signer (
reference/signer.py) - The reference verifier (
reference/verifier.py)
This policy does not cover:
- The Laiyr commercial platform (laiyr.ai) — for that, contact trust@laiyr.ai with subject "Platform Security"
- Third-party implementations of this specification
- Vulnerabilities in dependencies of the reference implementation (please report to the dependency maintainers)
We follow a coordinated disclosure model:
- Day 0: Report received and acknowledged
- Day 1–14: Investigation, severity assessment, and patch development
- Day 14–30: Coordinated patch release and public disclosure
- After Day 30: If no response from the maintainers within this window, the reporter may publish at their discretion
For high-severity issues, this timeline may be compressed.
If you discover a cryptographic weakness in the VBR™ signing or verification model — including but not limited to issues with ECDSA P-256, SHA-256, RFC 8785 JCS canonicalization, key publication, or signature encoding — please report it via the email above with the subject prefix "[CRYPTO]". We treat cryptographic vulnerabilities as critical-severity by default.
Reporters who follow this responsible disclosure process will be credited in the changelog when the patch is released, unless the reporter requests anonymity.