rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# Security Policy & Vulnerability Disclosure

Rivox takes supply-chain integrity, process isolation, and build coordination security seriously.

---

## Supported Versions

| Version | Supported | Security Patch Guarantee |
|---|---|---|
| 1.0.x | Yes | Active Support |
| < 1.0 | No | End of Life |

---

## Reporting a Vulnerability

If you discover a security vulnerability in Rivox (including path traversal, sandbox escape, CAS poisoning, integer overflow, or provenance forgery), please report it confidentially.

**Do NOT report security vulnerabilities through public GitHub issues.**

Instead, please email a detailed report to:
📧 **aaryan28rwt@gmail.com**

### What to Include in Your Report:
- A detailed description of the vulnerability and affected component (e.g. Ingestion Adapter, CAS, Sandbox, Provenance Generator).
- Steps to reproduce or a Proof-of-Concept (PoC) repository/script.
- Potential impact (e.g. host filesystem write access, unauthorized network outbound egress inside sandbox).

### Response Timeline
- **Initial Acknowledgment**: Within 24 hours.
- **Triage & Impact Assessment**: Within 72 hours.
- **Security Patch Release**: Targeted within 7 to 14 days depending on severity.

Thank you for helping keep Rivox and its supply-chain ecosystem secure!