Responsible Disclosure

Response Timeline

These are our response targets, not guarantees. Complex reports may require additional investigation or coordination.

Security Boundaries

Ares Realm Studios includes local applications and optional connected services. The boundary depends on the feature you choose:

• Local products — product data and local-model activity remain on the user's hardware unless a connected feature is deliberately enabled.
• Accounts and licenses — passwords use salted, computationally expensive verifiers; session and member API credentials are stored as protected hashes; web sessions use secure, same-site cookies.
• L.U.C.Y. history backup — conversation history is encrypted in the browser before upload, and the server does not receive the decryption key.
• Ares Secrets Vault — secret labels and values are encrypted in the approved Android or desktop client before upload. The server stores ciphertext only, recovery keys stay with the user, and notes/MCP credentials cannot access the vault API.
• Other optional backups — some products, including EV3RLY Library, may store an account-scoped JSON backup. These backups are not end-to-end encrypted unless the product explicitly says otherwise.
• Hosted AI — prompt content is processed to provide a response and may pass through an automated safety check. Our application layer does not retain it as chat history unless encrypted history backup is enabled.
• Third-party providers — information needed for a request is sent to the provider selected by the user and is then governed by that provider's security and privacy practices.

Out of Scope

• Vulnerabilities in third-party AI model weights
• Issues requiring physical device access to exploit
• Theoretical attacks with no practical impact
• Issues in upstream dependencies where no fix is available

Acknowledgements

Researchers who responsibly disclose valid vulnerabilities will be credited in release notes if they wish.