We take security vulnerabilities and privacy boundary enforcement seriously. If you find a security vulnerability or a dataset leakage risk in LongArc, please contact the maintainers directly at security@longarc.dev or open a confidential advisory.

LongArc is a security-aware evaluation benchmark. We actively research:

• Memory prompt injection through ingested messages and event content
• Cross-person contamination in multi-entity memory stores
• Unauthorized consent overrides and stale permission retrieval
• Unintended revelation of sensitive personal facts (medical, romantic, financial)
• Unsafe proactive autonomous actions triggered by adversarial or ambiguous context

• We will acknowledge receipt of your vulnerability report within 48 hours.
• We will coordinate public disclosure timelines with reporters.
• We do not run automated bug bounties with financial rewards, but we will acknowledge valid disclosures in our release notes.