Vulnerability Disclosure

Published October 2026.

1. What is in scope

The signing chain is the part that matters. A receipt anyone can verify is only worth something if the key behind it is ours and stays ours.

• turiyahq.com and holynt.com. The two sites we operate.
• The anchor repository. Every root key we have claimed, the retirement list, the receipt specification and the test vectors at github.com/holynt-technologies/turiya-anchor.
• The signing chain. Anything that would let someone produce a receipt that verifies against our published key without holding it.
• Published receipts. A record whose signature verifies while its contents differ from what we signed.

One thing about that root is on the record rather than in a changelog: we rotated it on 8 October 2026, because the previous one was held somewhere our own ceremony forbids. The notice is here, and it says what that means for a receipt you already hold. The short version is that nothing was re-signed and nothing you hold has stopped verifying.

2. What is out of scope

• The infrastructure we rent rather than run: Vercel, GitHub, GitLab, Zoho, Cloudflare. Report those to the provider, and tell us if we are affected.
• Denial of service, load testing, and volumetric attacks.
• Social engineering, phishing, and physical access.
• Output from an automated scanner with no demonstrated impact.
• Missing security headers on responses we do not control, such as the host's error pages.

3. How to report

Write to security@turiyahq.com. Put the affected host or repository in the subject line so it sorts correctly.

Please do not open a public issue for a finding before we have had a chance to fix it.

4. What to include

What you found, the steps that reproduce it, what an attacker could do with it, and any logs or proof you have. A report that reproduces is worth more than one that describes.

5. What we commit to

• Acknowledge within 7 days, and tell you our initial assessment.
• Keep you updated until it is fixed or we have explained why it will not be.
• Not ask you to stay quiet indefinitely. We work to a 90-day window. If a fix needs longer, we will say so and agree a date rather than let the window pass in silence.
• Tell you when it is fixed, and credit you in the advisory unless you ask us not to.

6. Safe harbour

If you research in good faith and follow this policy, we will not pursue legal action against you, and we will say publicly that your research was authorised. Good faith means testing only what you need to demonstrate the finding, not accessing or altering data beyond that, not degrading the service, and giving us the window in section 5 before you publish.

This offer does not extend to extortion, to attacks on systems we do not operate, or to research that harms a third party.

7. What this is not

A commitment, not a certification. We publish no security rating for ourselves, and this page is not evidence that the sites are secure. It sets out what happens when you tell us they are not.

The same distinction applies to a receipt. A signature proves a record was not altered after signing. It proves nothing about whether the record is right.