Security Policy

Safe-use rules

• VITRINE is a static analyzer for defensive research and teaching. It never executes samples.
• This repository contains no malware. All fixtures are synthetic PEs generated by vitrine/synth.py. They have filler "code" and no executable logic; import tables only name APIs so that static features carry signal.
• Do not commit real samples. If you analyze real malware, use an isolated, offline lab VM, keep samples in password-protected archives, and follow your institution's handling policy.
• Generated YARA rules are candidates and need analyst review before deployment.
• Models are serialized as JSON, never pickle, so loading a model cannot run code.

Reporting a vulnerability

If you find a parser crash, hang, or other issue with a crafted input, please open a private report at https://github.com/rakshit-737/vitrine-malware-triage/security/advisories/new (GitHub private vulnerability reporting). Include a synthetic reproducer where possible, not a live sample.