Skip to content
RAW CARBONMaterials, made tangible.
Commercial Security & Assurance

Security Architecture & Responsible Disclosure

Storefront application defenses, RFC 9116 vulnerability reporting procedures, OpenPGP keys, and supply-chain verification for Raw Carbon.

Last Updated: September 6, 2026 · Scope: rawcarbon.store

Responsible Vulnerability Disclosure & Safe Harbor

Raw Carbon (operated by Abrams Research LLC) welcomes responsible vulnerability reports from the independent security community. If you discover a potential vulnerability in our storefront or order flow, please report it directly to our security team.

Reporting Contact
security@rawcarbon.store
Encrypted or plaintext reports
Triage Target
≤ 48-Hour Acknowledgment
Rapid verification and mitigation
Safe Harbor Guarantee: We will not initiate legal action against researchers who report findings in good faith, avoid automated high-rate scanning that disrupts service, and refrain from harvesting sensitive commercial customer data.

OpenPGP Encryption Key

Encrypt sensitive vulnerability submissions using our official RSA-4096 OpenPGP public key:

// Raw Carbon Store Security PGP Key
Fingerprint: 77AD CA0A 163E DE33 75A9 CC9C A6F7 95ED 4FD9 8A2A
User ID: Raw Carbon Security <security@rawcarbon.store>
Download security-pgp-key.txt

Research Scope & Prohibitions

In-Scope
  • rawcarbon.store storefront and catalog routes
  • Shopping cart context and RFQ submission flows
  • MIME type sniffing defenses and strict CSP compliance
  • Cross-Origin Isolation and COEP headers
Out-of-Scope
  • Denial of Service (DoS / DDoS) testing
  • Automated fuzzing that causes customer downtime
  • Physical supply-chain or warehouse facility testing
  • Social engineering or phishing of customer support

Architectural Controls & Standards Alignment

RFC 9116 Compliant

Active security manifest published at /.well-known/security.txt with annual rolling expiry.

Cross-Origin Isolation

Armed with COEP: credentialless and COOP: same-origin to eliminate side-channel leakage.

OWASP ASVS 5.0.0

Strict Content-Security-Policy with object-src 'none', base-uri 'self', and form-action 'self'.

Supply Chain SBOM

Build-time CycloneDX software bill of materials tracking all dependencies and subcomponents.

← Commercial TermsBrowse Materials