Institutional Assurance & Systems Engineering

Security Architecture & Responsible Disclosure

Operational guidelines, vulnerability reporting protocols, cryptographic verification keys, safe harbor protections, and standards alignment across Abrams Research Systems LLC.

Responsible Vulnerability Disclosure & Safe Harbor

Abrams Research Systems LLC encourages coordinated, responsible disclosure of any software vulnerability or telemetry protocol defect. We consider security research conducted under these guidelines to be authorized and will not pursue civil or criminal legal action against researchers acting in good faith.

Primary Contact

security@abramsresearch.net

Direct unencrypted or PGP-encrypted triage inbox

Response Commitment

≤ 48-Hour SLA

Initial triage response within 2 business days

Safe Harbor Terms: You must avoid privacy violations, data destruction, and service degradation (no DoS/DDoS). Provide a minimum 60-day remediation window before public disclosure.

OpenPGP Cryptographic Verification

For end-to-end encrypted vulnerability reports or to verify signatures from Abrams Research security personnel, download our sovereign OpenPGP public key:

// Primary Sovereign OpenPGP Key

Fingerprint: D62A 8710 246A B03B 336C 484B 05AC 7747 9929 7D90

User ID: Abrams Research Security <security@abramsresearch.net>

Download security-pgp-key.txt

Research Scope & Boundaries

In-Scope Surfaces

abramsresearch.net primary domain and routes
AEA trajectory and relativity calculation models
Client-side metrology sandbox state machines
Content Security Policy & Cross-Origin Isolation
DNSSEC and certificate authority authorization (CAA)

Out-of-Scope Activities

Denial of Service (DoS / DDoS) attacks
Physical security attacks against facilities or hardware
Social engineering or phishing of personnel
Spam, automated high-volume vulnerability scanners
Upstream DNS root or transit registrar infrastructure

Standards Mapping & Architectural Controls

Abrams Research software infrastructure is engineered under deterministic verification principles, mapped directly to authoritative cybersecurity frameworks:

OWASP ASVS 5.0.0

Mapped to Level 1 & Level 2 controls: strict CSP, COOP/COEP isolation, input escaping, and zero inline eval execution.

NIST SSDF (SP 800-218)

Secure Software Development Framework: reproducible builds, automated dependency review, and CycloneDX SBOM artifact tracking.

RFC 9116 Compliant

Published machine-readable manifest at /.well-known/security.txt with rolling annual expiry and PGP linking.

Cross-Origin Isolation

Enforces Cross-Origin-Embedder-Policy: credentialless and Cross-Origin-Opener-Policy: same-origin for thread isolation.

← Return to Public Disclosures Explore Capabilities