Security & disclosure policy

Effective 17 October 2026

1. Reporting a vulnerability

If you believe you have found a security vulnerability in Arka, this website, the live demo or the update service, please email contact@vulntech.com with the subject Security. Please include the affected version, a description of the issue, the steps to reproduce it and its impact as you understand it.

Please do not report vulnerabilities through public channels before we have had a chance to fix them.

2. What to expect

We acknowledge reports within 3 working days and keep you informed of our progress.
We aim to fix confirmed vulnerabilities promptly, and to release a signed update that Arka installations are offered automatically.
With your permission, we credit you in the release notes once a fix is available.

3. Rules for good-faith research

We will not pursue action against research that is done in good faith and follows these rules:

test against your own installation of Arka wherever possible;
do not access, change or delete data that is not yours, and stop as soon as you reach such data;
do not degrade our services (no denial-of-service, spam or brute-force testing against our servers);
do not use social engineering or physical attacks;
give us reasonable time to fix an issue before you disclose it.

4. Keeping Arka secure

Every Arka release is signed with VulnTech's Ed25519 release key, and Arka refuses to install an update whose signature does not verify. Keep your installations up to date from the control panel's Updates page.