Security at TIV.
Security is an engineering discipline, not a marketing badge. We design for zero-trust, verify memory safety, operate transparent disclosure, and maintain open advisories.
Security architecture principles.
How TIV approaches the construction and maintenance of reliable infrastructure software.
Memory Safety & Minimal Surface
Our systems prioritize memory-safe languages and statically linked runtimes, minimizing external dynamic dependencies and unneeded attack surface.
Safe Harbor Disclosure
Good-faith security research is protected under our Safe Harbor commitment. We will not pursue legal action against researchers acting in accordance with our policy.
Verified Advisories
Every vulnerability is assigned a structured CVE/TIV identifier, with reproducible regression tests and clear patch remediation steps.
Vulnerability disclosure policy.
Guidelines for reporting and our commitment to researchers.
Reporting Protocol
Send vulnerability reports to security@tonmoyinfrastructure.org or via our contact portal using the Security category. Please encrypt sensitive technical details using our published PGP key whenever possible.
Response SLA Commitments
- Initial Acknowledgment: Within 48 hours of report receipt.
- Triage & Severity Assessment: Within 5 business days.
- Status Updates: Bi-weekly updates until remediation patch release.
Coordinated Release
We request a standard 90-day coordinated disclosure window before public release. In instances where an active zero-day exploit is observed, we accelerate patches within 24 to 72 hours.
Security advisories.
Published security advisories. TIV maintains absolute honesty and never fabricates advisories.
No Outstanding Advisories
PGP Security Key
Fingerprint for verified encrypted vulnerability disclosure:
Canonical security machine specification available at /.well-known/security.txt.
Report a Vulnerability
Direct submission channel for researchers, system administrators, and downstream operators.