This policy covers the public ENTENCY repository and the security of the project as described in its current documentation, including ENTENCY GNS (Global Neural System), ENTENCY UP, protocol and RPC/API surfaces, transport and authentication boundaries, storage and object handling, and related development tooling.

ENTENCY is under active foundational development. The public network, production hardening, and several ecosystem layers remain under development. This policy does not imply that any component is production-ready or that all security risks are solved.

Please do not open a public GitHub issue for an undisclosed security vulnerability.

Use GitHub's private vulnerability reporting feature for this repository when it is available. If private reporting is unavailable, contact the repository owner through an authenticated GitHub channel and request a private reporting route. Do not include secrets, personal data, or exploit material in a public issue.

If you cannot use GitHub private reporting, open a minimal issue asking for a private security contact without describing the vulnerability.

Please provide, as safely as possible:

• the affected component and version, commit, or branch;
• a concise description of the security impact;
• reproducible steps or a minimal proof of concept;
• relevant environment and configuration details;
• whether the issue affects confidentiality, integrity, availability, authority, or user safety;
• any proposed mitigation or known workaround.

Please redact credentials, private keys, tokens, personal data, and unrelated proprietary material.

Reports are especially useful when they concern:

• node identity, transport, peer discovery, or connection handling;
• object, manifest, chunk, content-verification, or reconstruction logic;
• GNS service publication, resolution, capability, or authorization boundaries;
• ENTENCY UP protocol routing, session control, runtime isolation, or local application execution;
• RPC/API input validation, authentication, authorization, or sensitive operations;
• dependency, packaging, update, release, or build-integrity issues.

Unless they demonstrate a concrete security impact, the following are generally out of scope:

• requests for new features or general bugs;
• issues in third-party services that are not controlled by ENTENCY;
• social engineering, phishing, or attacks against project participants;
• denial-of-service or resource-exhaustion testing against systems you do not own or have permission to test;
• spam, automated scanning, or public disclosure of an unremediated issue.

Do not access, modify, or delete data that does not belong to you.

Please allow the maintainers reasonable time to validate the report, prepare a fix, and coordinate a public advisory where appropriate. We will acknowledge valid reports, keep the reporter informed when practical, and coordinate disclosure timing based on risk and remediation status.

There is currently no bug bounty or guaranteed monetary reward program for ENTENCY.

Good-faith security research that follows this policy, avoids privacy violations and service disruption, and gives the maintainers a reasonable opportunity to respond is welcomed. These principles do not authorize testing of third-party systems or override applicable law.

ENTENCY follows an evidence-first approach. Implemented, validated, experimental, and planned capabilities are intentionally distinguished in the public documentation. Security claims should be based on reproducible implementation and testing evidence; this policy makes no absolute security guarantee.

Last updated: 2026-09-14