Policy redline diff

All material changes to the coordinated-disclosure policy. Each version has a stable URL via the ?v=N.M parameter on /policy.

1.0 — initial publication

2026-04-29 · author: security-lead · sha-256: f1c8…42d9 · cite

First public version. Defines scope, in-scope assets, out-of-scope (third-party-hosted), safe-harbour terms, response SLAs (acknowledge 24 h, triage 5 d, resolve per severity), and the hall of fame recognition pipeline. PGP key fingerprint 9E4A 0C7B … embedded in the policy footer.

Upcoming change windows

Material updates are announced 30 days before they take effect at status.cloakapi.io and to all known reporters. Editorial fixes (typos, broken links) are applied immediately and not recorded as a version bump.

Citing a specific version

To cite the exact policy text in a report or contract, append ?v=N.M to the policy URL: e.g. https://security.cloakapi.io/policy?v=1.0. Versions are immutable — the build pipeline keeps historical copies at versioned paths (rendered server-side from the policy location block).

Reproducing the diff

Every published version of the policy is rendered on this page, and the canonical current text lives at /policy/. To reproduce a diff locally, save the two versions you want to compare and run:

diff -u policy-v1.0.md policy-current.md