Security Vulnerability Disclosure

Effective: v1.4 general availability. Last updated: 2026-07-18.

We welcome good-faith reports that help protect Aletheia users.

Reporting

Email [email protected] with:

• affected product version, endpoint or component;
• clear reproduction steps and observed impact;
• whether customer data or credentials may be exposed;
• a minimal proof of concept; and
• contact and disclosure preferences.

Do not send customer binaries, credentials, destructive payloads or sensitive proof bytes by ordinary email. Ask for an approved secure transfer channel.

We target acknowledgement within three business days, initial triage within seven business days, and progress updates at least every 14 days while a valid report remains open. Complex fixes may take longer. We will coordinate public disclosure timing and credit where requested.

In scope

• Aletheia signed desktop installers and updater;
• aletheia.arbitersec.com and authenticated cloud APIs;
• authentication, tenancy, billing, deletion and evidence integrity;
• sandbox or model/tool boundary escapes; and
• vulnerabilities that expose customer binaries, evidence or proof bytes.

Out of scope

• denial of service requiring only high request volume;
• social engineering, spam or physical attacks;
• findings in unsupported, modified or unsigned builds;
• automated scanner output without a reproducible security impact; and
• attacks against third-party providers that do not demonstrate an Aletheia control failure.

Safe harbor

When research is conducted in good faith, avoids privacy violations and service disruption, uses only accounts and data the researcher is authorized to use, and allows a reasonable remediation period, Arbiter Security will not pursue legal action merely for bypassing a technical control to demonstrate the reported issue. This does not authorize access to other users' data or violation of third-party systems or law.