Responsible Disclosure of Defects in Law

Arxo's principles for verified findings, coordinated notification and public correction histories · version 1.0, October 25, 2026. Changes are listed in the page history.

Why

Inspired by coordinated vulnerability disclosure (CVD), adapted to publicly accessible law. In software, reporting a defect, verifying it, fixing it and publishing it form one process. Arxo applies the same process to published legal acts and to the systems that implement them: evidence, notification of every responsible party, and an open history for each finding.

A defect is a verifiable discrepancy in an act, its official publication or its implementation: between applicable provisions, language versions, a statute and a regulation, or a text and a calculation, table or form. A finding marked "with consequence" means that, in a concrete example, the literal text changes a right, an amount, a deadline, a category or a procedure for a person or an organisation. Proven actual harm is not required for this mark.

Published law is available to everyone. Analysing it in public needs no one's permission.

Principles

1. The goal is a correction. We report defects so that they get fixed. We describe the text and what it produces, not people or motives. We do not judge whether a rule is good policy, only whether its text is consistent. Every jurisdiction is treated under the same rules. We do not rank countries or authorities.

2. Only verified findings go public. A finding is verified by Arxo when:

• the official source, edition, dates of effect and exact quotation are given;
• the discrepancy is reproduced with an example or a comparison;
• related provisions, exceptions, transitional rules and other readings have been checked, and the finding has survived an attempt to refute it.

Candidates are not published. Interpretation questions are shown separately, with both readings. Language discrepancies that depend on how words are read are checked with a specialist in that language and that legal system; a different number, threshold sign or negation is shown by the quotations themselves. Counts of findings come only from the register and are always broken down by type.

3. A person decides; AI assists. AI reads the texts, turns provisions into executable rules and builds the checks. A person decides what counts as a defect: every finding was checked and approved by one of us before it was sent. The role of AI is stated on each finding.

4. Every finding can be checked without us. We publish a permanent identifier, the official address of the source and its edition, the quotation, a copy of the text with its SHA-256 hash, the inputs, the assumptions and the result. A way to check it without Arxo's tools is attached. Register data is open and machine-readable.

5. All responsible parties are notified at once. We notify the author of the provision, the official publisher and the operator of the implementing system at the same time, through official channels and, where we can, in their language. Each authority receives one consolidated report listing its findings, not a stream of similar complaints. New findings and corrections follow as addenda. Date, recipients and dispatch are recorded.

6. Published on the day of notification. A verified finding is published on the day all responsible parties are notified, without waiting for a reply. Publication happens either way, so it is never leverage or a threat. There are two exceptions: a date promised in advance to the press (stated on the finding), and a defect corrected before our report, which is published without notification and marked as such. Replies and corrections are added to the finding's history.

7. Evidence, not an exploitation guide. On the day of publication we give verifiable evidence and a safe example. A calculation that shows a discrepancy in a payment remains evidence. Instructions for deception, falsifying data or bypassing safeguards are never published. Details needed to remove the risk go to the responsible parties with the notification. Security vulnerabilities in government systems are outside these principles and are reported under information-security disclosure practice.

8. No conditions, no hidden interest. Our conclusions and publication do not depend on anyone buying our services. We do not take money for not publishing. Commercial offers are sent separately from defect reports. If we have been paid by the authority or another client for work on the same act, the finding says so, and where there is a conflict of interest an independent reviewer is involved.

9. Receipt, acceptance and correction are distinct.

• "Received": the authority acknowledged the report.
• "Accepted": the authority agreed with the finding.
• "Corrected": an official document exists and a verified "before → after" comparison shows the change.

Amendments to a provision, corrections to a publication and fixes to software are recorded separately. A link between a correction and our report is stated only when it is proven.

10. Disputes and reviews are public. The authority's position is shown next to Arxo's conclusion and kept separate from it. When an objection on the merits arrives, the finding is marked "under review", re-checked, and the outcome is published with reasons; earlier recipients are notified. A withdrawn finding keeps its identifier and history, and the earlier conclusion is no longer shown as current. The share of withdrawn findings is published. If someone described the defect before us, we credit them.

11. We do not exploit defects. We never file applications or carry out transactions that make use of a defect. Systems are tested only through their public interfaces and with our own data.

12. No harm to people. Examples are synthetic and contain no personal data. Correspondence and staff names are not published without consent; the authority's position is summarised without disclosing correspondence.

What we suggest to public authorities

These principles fit into existing procedures for handling public submissions and monitoring legislation.

1. A clear entry point. Publish where to report defects in the authority's acts and systems, and who forwards reports to the competent body — just as contacts for reporting security vulnerabilities are published. 2. A reference number and an answer on the merits. Link the submission number to the finding identifiers, and give a decision with reasons for each finding. 3. A verifiable correction. Distinguish an amendment to a provision, a correction to a publication and a fix to software. Publish the basis, the date and the "before → after" result. 4. Coordination. For findings that involve several authorities, appoint a coordinator within the existing system for handling submissions.

Contact

Objections, reports of our own mistakes and requests for verification: hi@arxo.io. Please give the finding identifier, the conclusion you dispute and your source. We acknowledge receipt within five working days and answer on the merits within ten. Register: arxo.io/findings.