# Security Advisory Template

Use this template for publishing security advisories on Actyra Open after the
disclosure window has elapsed.

---

# ACTYRA-[YEAR]-[NUMBER]: [Short Title]

**Published:** [Date]
**Last Updated:** [Date]
**Advisory ID:** ACTYRA-[YEAR]-[NUMBER]
**CVE ID:** [CVE-YEAR-XXXXX] (if assigned)

## Overview

| Field | Value |
|-------|-------|
| **Vendor** | [Vendor Name] |
| **Product** | [Product Name] |
| **Affected Version(s)** | [Version(s)] |
| **Fixed Version** | [Version] / Not fixed |
| **Vulnerability Type** | [CWE-XXX: Description] |
| **CVSS 3.1 Score** | [Score] ([Severity]) |
| **CVSS 3.1 Vector** | [CVSS:3.1/AV:.../AC:.../...] |
| **Finding ID** | [Internal ID, e.g., avs-ga-001] |
| **Discovery Date** | [Date] |
| **Vendor Notified** | [Date] |
| **Public Disclosure** | [Date] |

## Summary

[1-2 paragraph plain-language summary of the vulnerability, suitable for a
non-technical audience. What is the risk? Who is affected?]

## Technical Details

[Detailed technical description including:
- Vulnerable component (function name, DLL, address)
- Root cause
- Attack vector
- Code-level evidence (minimum necessary excerpts)]

### Affected Code

```
[Decompiled pseudocode or source — limited to relevant excerpt]
```

### Proof of Concept

[Description of how the vulnerability can be confirmed, without providing
a weaponized exploit. Focus on detection, not exploitation.]

## Impact

[Description of what an attacker could achieve by exploiting this vulnerability.
Include CVSS breakdown rationale.]

## Remediation

### For the Vendor

[Specific technical recommendations for fixing the vulnerability]

### For Users

[What end users can do to mitigate risk until a fix is available]

## Timeline

| Date | Event |
|------|-------|
| [Date] | Vulnerability discovered during binary analysis |
| [Date] | Vendor notified via [channel] |
| [Date] | Vendor acknowledged receipt |
| [Date] | [Additional milestones] |
| [Date] | Public disclosure |

## Vendor Response

[Summary of vendor's response, if any. If the vendor did not respond,
state: "Vendor did not respond to [N] contact attempts over [N] days."]

## References

- [Link to CWE entry]
- [Link to related advisories]
- [Link to vendor's security page]
- Actyra Disclosure Policy: https://open.actyra.com/responsible-disclosure/

## Credit

This vulnerability was discovered by Actyra (https://actyra.com) during routine
binary analysis research. Actyra Open: https://open.actyra.com

---

## Advisory Numbering Convention

Format: `ACTYRA-[YEAR]-[SEQUENTIAL_NUMBER]`

Examples:
- ACTYRA-2026-001 (first advisory of 2026)
- ACTYRA-2026-002
- ACTYRA-2026-003

## Publication Checklist

Before publishing a security advisory:

- [ ] 90-day disclosure window has elapsed (or vendor has patched)
- [ ] Vendor was notified (document all contact attempts)
- [ ] CVE requested from MITRE (if applicable)
- [ ] CVSS score independently verified
- [ ] Evidence excerpts are minimum necessary (no full source dump)
- [ ] Advisory reviewed for accuracy by second analyst
- [ ] Advisory does not contain weaponized exploit code
- [ ] User mitigation guidance is included
- [ ] All dates and version numbers are accurate
- [ ] Advisory is filed in docs/advisories/ directory
