---
name: "Security vulnerability report"
about: "Report a security issue privately and responsibly"
title: "[SECURITY] Short description of the issue"
labels: [ "security" ]
assignees: [ "ariffazil" ]
---

> ⚠️ Please **do not** include exploit details, secrets, or private data in this public issue.
> For sensitive information, use encrypted channels only (see SECURITY.md for PGP details).

## Summary

Briefly describe the suspected vulnerability.

- **Component(s) affected** (e.g. APEX, Cooling Ledger, Vault-999, guard, infra):
- **Impact** (e.g. data integrity, confidentiality, availability, governance bypass):

## Environment

- arifOS version / git commit:
- Runtime environment (dev / staging / prod / other):
- Any relevant configuration (omit secrets):

## Steps to reproduce (high-level)

Describe how the issue can be triggered, without sharing a full exploit or confidential data.

1. …
2. …
3. …

## Expected vs actual behavior

- **Expected:**
- **Actual:**

## Sensitive details & PoC

Do **not** add PoC code, raw logs, or secrets here.

If you have a working PoC or sensitive evidence, please:
- Use a GitHub Security Advisory to start a private discussion, or
- Email: arifbfazil@gmail.com (encrypt using the project PGP key — see SECURITY.md)

## Additional context

Any extra information that is safe to share publicly (sanitized logs, screenshots, etc).

---

Thank you for helping keep arifOS secure. 🙏
