Right of reply and corrections

DRAFT pending legal review. The proposed default notice period is 14 days.

1. Notice: before publishing, we send the author a private notice through the contact in the repo or registry (security policy, then the maintainer email, then a GitHub issue that only says "please contact us" with no findings). We include the draft report, raw logs, version and hash, and the date we plan to publish.
2. Notice period: 14 days for a standard report. If we see apparently live harm (data sent to a third party), we notify the author and the hosting registry privately and hold the report; we do not publish early. Any early publication needs sign-off from the operator.
3. Reply: the author can send a response of up to 300 words, which we publish verbatim, and can ask us to re-test a new version before publication, which we will do once.
4. Corrections: a factual error the logs confirm is corrected within 3 business days, with a dated "Corrected on…" note. Silent edits are not allowed.
5. Disputes: if we disagree, we keep the report but add the author's statement and a note that it is disputed.
6. Takedowns: a report comes down if it is shown to be wrong, if the version is yanked and the author asks, or if a court or legal notice requires it. Every legal notice goes to the notices contact published on this site before launch before anyone replies. We do not delete anything while a notice is pending; we switch the report to "temporarily unavailable".
7. Records: we keep the notice, the reply and the raw logs for each report for at least 3 years.