Vulnerability disclosure and safe handling.

01 / ACTIVATION STATUS

Activation blocked.

A dedicated monitored vulnerability-reporting mailbox or approved external intake and its receiving operator have not been configured in this release. Do not send vulnerability details through the general contact form. Existing users should use their established private support channel.

No file uploads: this workflow will not accept public vulnerability attachments.

02 / SCOPE

Scope is limited to Blackvalley-owned public services explicitly named at activation.

The candidate scope is blackvalley.com and its same-origin public endpoint. Third-party services, customer systems, private mission applications, personnel, social engineering, denial of service, destructive testing, and data not owned by the reporter are excluded. No target is authorized merely because it references Blackvalley.

03 / SAFE HARBOR

Safe harbor — Owner/legal approval pending.

This draft does not grant authorization to test. Any future safe-harbor language must be approved by the Owner and legal counsel, tied to the final scope, and published before it may be relied upon.

04 / HANDLING EXPECTATIONS

Minimize access, impact, and initial disclosure.

Prohibited data: Keep credentials, personal data, and third-party information out of the initial report.

• Do not persist, alter, download, disclose, or publicly discuss data or exploit details.
• Preserve minimal timestamps and reproduction notes without expanding access.
• Wait for an approved protected exchange before transmitting substantive evidence.

05 / TRIAGE OWNER

Triage owner: Blackvalley Security intake role.

No individual reviewer identity is published. The role becomes operational only after a monitored channel, accountable operator, acknowledgement target, escalation route, and a successful delivery and triage drill are recorded.

06 / RETENTION

Retention and handling controls must be approved before activation.

This static policy stores no reports. The future receiving system must document its minimum necessary retention, access boundary, deletion and legal-hold behavior, and provider handling before the channel can be represented as operational.

07 / EXPIRY AND RENEWAL

Expiry and renewal: security.txt expires 2027-08-18T23:59:59Z.

The repository gate fails after expiry. The security owner must review the channel, policy, scope, and operator at least 30 days before expiry, then update and revalidate the machine-readable record with the same release artifact.