> Markdown twin of https://adna.network/security/
> Index: https://adna.network/llms.txt · Full corpus: https://adna.network/llms-full.txt
> State is a build-time snapshot generated 2026-09-11 (UTC); nothing here is live.
> Derived from the rendered page — this route has no markdown source.

# Security & Disclosure

aDNA is an open standard and a set of plain-Markdown, local-first knowledge vaults.
The project ships no runtime service by default. Even so, we take coordinated
disclosure seriously — here is how to report a vulnerability and what to expect.

## Reporting a vulnerability

**Please report privately — do not open a public issue for a security problem.**
Open a private report through GitHub Security Advisories on the canonical repository:

[Report a vulnerability privately →](https://github.com/aDNA-Network/aDNA/security/advisories/new)

If you cannot use GitHub Security Advisories, open a public issue that says only
“security report — please open a private channel”. Include no details
there. A maintainer will follow up privately. When you can, tell us the affected file,
route or script, the steps to reproduce it, and the impact you expect.

## Scope

**In scope:** the published standard and its templates — the
`.adna/` tree, the skills, the governance templates. The website tooling and
build scripts in the repository (`site/`, `scripts/`). And anything
the repository runs itself: CI, and the gate harness.

**Out of scope:** third-party tools that aDNA works alongside — Obsidian,
Claude Code, git hosts. Report those to their own maintainers. Also out of scope:
deployments and private vaults you run on your own machines.

## What to expect

- **Acknowledgement** — we aim to acknowledge a report within a few business days.
- **Assessment** — we confirm the issue, determine severity and affected versions, and keep you updated.
- **Coordinated disclosure** — we agree a disclosure timeline with you and credit you in the advisory unless you prefer to remain anonymous.

## Securing your own vault

aDNA vaults are local-first by design and are not pushed to a remote unless you configure
one. Treat your vault's inventory, credentials index, and node identity as sensitive, and
never commit real secrets — the standard's credential-handling doctrine keeps secret
*names*, never secret *values*, in the vault.

The machine-readable policy is also at
[`SECURITY.md`](https://github.com/aDNA-Network/aDNA/blob/main/SECURITY.md)
in the repository.