Do not publish a suspected vulnerability affecting Arcana, Silentium Labs infrastructure, or a third party in a public issue, pull request, discussion, or sample artifact.

Use Silentium Labs’ private security contact channel. If you do not already have a designated contact, begin through the contact path on silentiumlabs.io and avoid sending sensitive technical detail until a private channel is confirmed.

Include only the minimum information needed to establish contact. Never place credentials, sensitive evidence, personal data, or private keys in an initial message.

This repository is deliberately designed as a public-safe representation of Arcana. A contribution must not include:

• secrets, credentials, session material, or private keys;
• private infrastructure, controller configuration, or worker internals;
• live assessment data, real targets, customer information, or raw third-party evidence;
• unpublished vulnerability details or private disclosure correspondence; or
• weaponized exploit, payload, credential theft, stealth, or evasion logic.

If the publication status is uncertain, do not commit it. Review docs/PUBLICATION_BOUNDARY.md.

Before every commit intended for publication:

• run the review in docs/CODEX_SECURITY_REVIEW_PROMPT.md;
• scan the working tree and staged diff for secrets and private data;
• run Gitleaks and TruffleHog (or equivalent) when available;
• inspect Git history, not only the current files;
• inspect screenshots pixel-by-pixel for real targets, workstation details, and private data;
• strip and inspect EXIF and embedded image metadata; and
• inspect archives, generated files, fixtures, comments, and sample configuration.

If a secret or private artifact has ever entered Git history, removing the current file is not enough. Rotate affected credentials and rewrite history before publication.