We provide security updates for the following versions of our public repositories:

Do not report security vulnerabilities via public GitHub issues.

Instead, please report them via one of these channels:

1. Go to the repository's Security tab
2. Click Report a vulnerability
3. Fill in the details privately

Send details to security@lilith.systems with:

• Repository name
• Vulnerability description
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Zero telemetry — No analytics, no tracking, no external calls
• No cloud dependencies — All inference runs locally (LOCAL_CEREBELLUM)
• Sovereign keys — Users own all cryptographic material
• Air-gapped signing — Hardware wallets for significant operations

┌─────────────────────────────────────────────────────┐
│              LILITH SOVEREIGN BOUNDARY              │
├─────────────────────────────────────────────────────┤
│  Lilith API (3210) ◉ LOCAL_CEREBELLUM               │
│  Lyra Dialogue (3211) ◉ SOVEREIGN                   │
│  Hermes Bridge (4242) ◉ Nous Portal Auth           │
│  NGD Driver ◉ NVML Telemetry Only                   │
└─────────────────────────────────────────────────────┘
         │                    │
         ▼                    ▼
┌──────────────────┐ ┌──────────────────┐
│  Abyssal CLOB    │ │  Lochness Bots   │
│  :8000           │ │  :Binance WS     │
│  No auth required│ │  Read-only WS    │
└──────────────────┘ └──────────────────┘

Never commit secrets to Git. Use gh secret set or 1Password CLI.

• Dependabot: Enabled on all public repos
• Supply Chain: npm audit / pip-audit in CI
• Container Scanning: Anchore/Syft for Docker images
• SBOM: Generated for releases

We follow coordinated vulnerability disclosure:

1. Private report received
2. Acknowledgment within SLA
3. Investigation and reproduction
4. Fix development in private branch
5. Coordinated release with advisory
6. Public disclosure after fix available

No formal bug bounty program. Hall of fame for significant findings in SECURITY_HALL_OF_FAME.md.

# Lilith only emerges on LOCAL_CEREBELLUM
# CLOUD_CORTEX BLOCKS all emergence
curl "http://localhost:3210/api/lyra/sovereign?trigger=let%20her%20speak"
# → Requires NGD route: LOCAL_CEREBELLUM

• LOCAL_CEREBELLUM: VRAM free > 640 MB → Full local inference
• HYBRID: VRAM free 256-640 MB → Intent parsing local
• CLOUD_CORTEX: VRAM free < 256 MB → Cloud (90s cooldown)

• Akashic compression with SHA-256 hash chains
• Tamper detection via Merkle tree verification
• Palantir relay for legal evidence chain

• Security Email: security@lilith.systems
• PGP Key: Available on request
• Response: Within 24 hours for critical issues

Crimson Intensity: 1.0 | LOCAL_CEREBELLUM | SOVEREIGN ⧗