Applies to: All 25 repositories under
@RitualDev-Lab
Official Intake:security@ritualdev.in
PGP Public Key: https://ritualdev.in/pgp-key.txt
Security Policy (RFC 9116): https://ritualdev.in/.well-known/security.txt
Trust Center: https://ritualdev.in/trust
Effective Date: November 2026
RitualDev Lab provides active security patching and vulnerability mitigation for the following operational software branches:
| Project / Repository | Supported Versions | Security Support Status | Patch Turnaround SLA |
|---|---|---|---|
AgentShield (@ritualdev-lab/agentshield) |
v0.2.x, main |
✅ Active (24/7/365) | < 24 Hours (Critical) |
DBShield (@ritualdev-lab/dbshield) |
v0.2.x, main |
✅ Active (24/7/365) | < 24 Hours (Critical) |
SkillPrism (@ritualdev-lab/skillprism) |
v0.1.x, main |
✅ Active | < 48 Hours |
WebSecAuditor (web-sec-auditor) |
v0.1.x, main |
✅ Active | < 48 Hours |
GitWhisper (@ritualdev-lab/gitwhisper) |
v0.1.x, main |
✅ Active | < 48 Hours |
| Ritual Agent Defense IDE | Latest published | ✅ Active | < 48 Hours |
ritualdev-web (ritualdev.in) |
Production main |
✅ Active | < 12 Hours |
If you discover a security vulnerability, zero-day evasion, or sensitive data leakage within any RitualDev Lab repository or utility, please report it through our coordinated disclosure channels:
- Email Intake: Dispatch encrypted details to
security@ritualdev.in. - PGP Encryption: For confidential findings, encrypt communications using our official PGP key at https://ritualdev.in/pgp-key.txt.
- GitHub Private Vulnerability Reporting: You may also utilize GitHub's Private Vulnerability Reporting feature on any individual repository under
RitualDev-Lab.
- Initial Response & Human Triage: < 1 hour for P1 critical severity; < 4 hours for P2 high severity.
- Triage Assessment & Status Updates: Provided every 12 hours until full resolution.
- Coordinated Disclosure Policy: We request a 90-day embargo following notification to allow for patch deployment and upstream consumer notification before public disclosure.
RitualDev operates under strict Zero-Data-Retention and Local-First principles:
- Indian Digital Personal Data Protection Act, 2023 (DPDP Act): Zero lines of customer code, API tokens, or prompts are transmitted or stored by RitualDev systems.
- European Union General Data Protection Regulation (GDPR): Execution occurs 100% locally on developer machines or inside customer VPC runners; zero cross-border personal data transfers occur under Chapter V.
- NIST SP 800-218 & US Executive Order 14028: All releases include automated CycloneDX / SPDX Software Bill of Materials (SBOMs) with cryptographic SLSA Level 3 provenance.
Valid, responsible security vulnerability disclosures are publicly recognized on our Security Hall of Fame and eligible for discretionary bounties based on CVSS 3.1 severity impact.