The following versions of spark-hive are currently supported with security updates:
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
We take the security of spark-hive and sovereign agent infrastructure seriously. If you discover a vulnerability, please report it responsibly rather than opening a public issue.
- Email:
aien@aienos.com - GPG Key: Available upon request or via public keyservers.
- Detailed description of the vulnerability and attack vector.
- Minimal reproduction steps or proof-of-concept.
- Affected modules or dependencies.
- Suggested mitigation or patch if available.
- Initial Response: Within 24 hours.
- Triage Assessment: Within 48 hours.
- Patch Release: Coordinated disclosure within 14 days or earlier depending on severity.
- Zero plaintext API tokens or keys on disk. All integrations must use hardware TPM vault or secure loopback credential injection.
- Loopback isolation: Daemons and internal IPC default strictly to
127.0.0.1. - Safe deserialization: Untrusted inputs are strictly schema-validated before processing.