> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grantex.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Policy

> Supported versions, vulnerability reporting, and coordinated disclosure.

## Supported Versions

| Component | Version | Supported |
| - | - | - |
| Protocol spec | v1.0 | Yes |
| `@grantex/sdk` | 0.1.x | Yes |
| `grantex` (Python) | 0.1.x | Yes |
| `@grantex/langchain` | 0.1.x | Yes |
| `@grantex/autogen` | 0.1.x | Yes |
| `@grantex/vercel-ai` | 0.1.x | Yes |
| `grantex-crewai` | 0.1.x | Yes |
| `@grantex/cli` | 0.1.x | Yes |

If you are running a version not listed above, please upgrade before reporting.

## Reporting a Vulnerability

<Warning>
  Do not open a public GitHub issue for security vulnerabilities.
</Warning>

Send a report to **[sanjeev@orchestrum.in](mailto:sanjeev@orchestrum.in) or [mishra.sanjeev@gmail.com](mailto:mishra.sanjeev@gmail.com)** with:

* A clear description of the vulnerability and its potential impact
* The affected component(s): `auth-service`, `sdk-ts`, `sdk-py`, `cli`, or `SPEC.md`
* Steps to reproduce or a minimal proof-of-concept
* Any suggested mitigations you have identified

For encrypted reporting, email `sanjeev@orchestrum.in or mishra.sanjeev@gmail.com` with the subject **PGP key request** and verify the returned fingerprint through the same address. No public PGP-key URL is currently published.

## Response SLA

| Stage | Target |
| - | - |
| Acknowledgement | 48 hours |
| Substantive response | 7 business days |
| Patch (Critical / High) | 30 days from confirmation |
| Patch (Medium / Low) | Next scheduled release |

## Coordinated Disclosure

1. Reporter submits vulnerability to `sanjeev@orchestrum.in or mishra.sanjeev@gmail.com`
2. Triage, reproduce, and confirm within 7 business days
3. Develop and test a fix, keeping the reporter in the loop
4. Publish a patched release and a CVE (if applicable)
5. Reporter is credited (or anonymously, at their choice) in release notes
6. Reporter may publish their write-up 30 days after the patch ships

## Scope

### In scope

| Component | Examples |
| - | - |
| `auth-service` | Token issuance, verification, revocation, delegation |
| `sdk-ts` | Client-side token handling, JWT verify |
| `sdk-py` | Same surface as sdk-ts |
| `langchain` | Scope enforcement, audit callbacks |
| `autogen` | Function registry, scope enforcement |
| `vercel-ai` | Tool scope checks, audit logging |
| `crewai` | Tool scope enforcement |
| `cli` | CLI tool, credential handling |
| `portal` | Developer portal, auth flow, API key handling |
| `SPEC.md` | Protocol design flaws |

### Out of scope

* Vulnerabilities in third-party dependencies (report upstream; let us know so we can track)
* Physical access attacks
* Social engineering
* Denial-of-service attacks against hosted infrastructure
* Findings requiring existing admin credentials with no privilege escalation
* Automated scanner output without evidence of exploitability

## Bug Bounty

We do not currently operate a formal bug bounty programme. With the researcher's permission, impactful reports may be recognized in release notes. No separate public Hall of Thanks page is currently published.

## Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: [sanjeev@orchestrum.in](mailto:sanjeev@orchestrum.in) or [mishra.sanjeev@gmail.com](mailto:mishra.sanjeev@gmail.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.