Please do not open a public GitHub issue for security vulnerabilities.

Instead, email security@<project> with:

1. A clear description of the vulnerability
2. Steps to reproduce (or proof-of-concept)
3. Potential impact (who is affected, what can be done)
4. Your suggested remediation (if you have one)
5. Whether you wish to be credited, and under what name

We will acknowledge receipt within 72 hours and aim to provide an initial assessment within 7 days.

• In scope:

  • Bugs in OpenHuizeBox code that could allow VM escape
  • Flaws that let the target software detect the sandbox (reducing research effectiveness) — treat as security-relevant bugs
  • Secrets or API keys accidentally committed
  • Supply-chain issues in our dependencies

• Out of scope:

  • Vulnerabilities in Oracle VirtualBox itself — report to Oracle
  • Theoretical attacks that require admin access to the host
  • Social engineering
  • Bugs in the target software being analyzed (that's why you're analyzing it)

We follow a coordinated disclosure timeline:

1. Day 0: report received
2. Day 1–3: acknowledged
3. Day 4–30: triaged, fix developed
4. Day 31–60: fix released, CVE requested if applicable
5. Day 61+: public disclosure

We will delay public disclosure if a downstream user (enterprise, regulator, etc.) needs more time to roll out the patch, but not indefinitely.

(No advisories yet — this project is new.)