The MitsuoLabs™ Legal Framework is designed for maximum resilience and ethical integrity. Accordingly, we treat violations of our ethical commitments with the same gravity as critical security vulnerabilities. This document provides the single, official channel for reporting sensitive issues related to either technical security or ethical compliance.

Your responsible disclosure is essential to maintaining the integrity of this framework and protecting its users. We are committed to working with the community to verify and address all legitimate reports.

This policy applies to two categories of reports:

1. Technical Security Vulnerabilities: Any potential flaw in the legal texts, documentation, or associated code that could be exploited to cause a security breach, data loss, or other unintended and harmful behavior.
2. Ethical Use Covenant Violations: Any suspected use of software licensed under the MRSL-1.0 Stewardship Rider that appears to violate the specific prohibitions laid out in the Ethical Use Covenant (Section 25 of the MRSL-1.0).

DO NOT report security or ethical compliance issues through public GitHub issues, pull requests, or other public forums.

Instead, please send a detailed report directly to the following private email alias:

contact@mitsuolabs.com

Please include the following in your report:

• A clear and descriptive subject line (e.g., "Security Vulnerability Report" or "Ethical Covenant Violation Report").
• A detailed description of the issue. For technical vulnerabilities, include steps to reproduce the issue. For ethical violations, include links, screenshots, or any other evidence that supports the claim.
• Any platforms, versions, or configurations that are affected.
• Your name or alias and a contact email address.

We pledge to handle all reports with the seriousness and confidentiality they deserve:

• We will acknowledge receipt of your report within 48 business hours.
• We will conduct a thorough investigation and will not dismiss reports without due consideration.
• We will maintain a private, respectful line of communication with you during the investigation.
• We will take appropriate action to remediate any confirmed vulnerability or violation, which may include issuing patches, publishing advisories, or taking enforcement action under the terms of the applicable license.

We consider good-faith security research to be a vital contribution to the security of our ecosystem. We provide a legal Safe Harbor for any security research that is conducted in accordance with this policy and the principles of coordinated disclosure.

We will not initiate legal action against you for circumventing technological protection measures or for otherwise violating the letter of our licenses, provided that your research is conducted in good faith and for the sole purpose of identifying and reporting a security vulnerability to us. This Safe Harbor is void if your research is negligent, causes public harm, is conducted in bad faith, or exceeds the authorized scope of testing.