ERC-TRUST is an unaudited research and reference candidate. The shipped candidate is 0.1.0-candidate.2; the successor under development on public main carries the working label 0.2.0-candidate.1 and has no tag or release. Neither is for production use. No deployed instance, fork, proxy, migration, operator, key-management process, or downstream integration is covered by this policy.

This table describes report handling, not a warranty or a promise that the candidate is secure.

Use GitHub Private Vulnerability Reporting for this public repository:

1. Open the repository's Security tab.
2. Select Advisories.
3. Select Report a vulnerability.

If the GitHub private reporting form is unavailable, contact the maintainer at jay@oraclizer.io with the subject ERC-TRUST SECURITY. Do not include secrets, personal data, production credentials, or unrelated private deployment information.

Do not disclose exploit details in a public issue, Pull Request, discussion, social post, or standards forum.

Provide enough information to reproduce and assess the report:

• the exact commit, file, function, and profile;
• a minimal reproduction, failing test, proof counterexample, or transaction sequence;
• expected and observed state transitions;
• affected balances, records, nonces, events, or receipts;
• whether the issue crosses a declared claim or trust boundary;
• known preconditions and impact;
• suggested embargo needs, if any.

Good-faith reports that challenge the model-to-code mapping, fail-closed behavior, authorization binding, route isolation, state-frame claims, canonical receipt, profile topology, or verification harness are in scope.

The maintainer will evaluate whether a report affects the candidate and may request additional information. There is no guaranteed acknowledgement, remediation, disclosure, or release timeline. There is no bug bounty or financial reward program.

If a report is accepted, the maintainer may coordinate a fix and disclosure through a draft GitHub Security Advisory. Credit may be offered in the advisory or release notes when requested and appropriate.

Public design questions, non-sensitive specification ambiguities, and ordinary bugs may use the issue tracker after the repository becomes public.

The successor Foundry, Kontrol, Certora, mutation, deterministic-build, runtime-binding, obligation-ledger, and Isabelle results apply only to their exact source, runtime, harnesses, assumptions, and claim boundaries. The successor Certora receipt covers four named rules on the current ERC-3643 Partial adapter runtime; receipts under evidence/candidate-2/ describe different historical bytes. None of these results is an independent security audit or covers deployments or external legal and factual truth.

See:

• Verification summary
• Known limitations
• Public claim matrix
• Disclaimer
• Formal verification and refinement map

The current implementation, SDK, tooling, and formal artifacts are provided under the BSD 3-Clause License, including its warranty disclaimer and limitation of liability. The proposed ERC text is under CC0, and four byte-bound historical pilot source files retain file-level MIT headers, as listed in the README. This policy does not expand any license, create a support contract, or make a representation about security, fitness, legal compliance, or production readiness.