Introducing Groundwork

Every application you use is mostly code its makers didn't write. Underneath the product sit frameworks, underneath those sit libraries, and at the bottom sit the parsers, compressors, crypto and networking code that everything else assumes is solid. Much of it is maintained by a handful of people in their spare time.

That bottom layer is where a single bug travels furthest, and it's where attackers increasingly look first, now with AI doing a lot of the searching for them.

What Groundwork does

We spend our research time on that layer. We look for memory-safety bugs, parsing mistakes, logic errors and unsafe defaults in widely used open-source projects. When we find one, we reproduce it, work out how serious it really is, and report it privately to the maintainers with everything they need: a clear description, a proof of concept, and where we can, a proposed patch.

Then we stay on it until it's fixed. We answer questions, review the maintainers' fix, and help test it.

How we disclose

We follow coordinated disclosure. A finding stays private while the maintainers work on it. It becomes public once a fix has shipped, or 90 days after we reported it, whichever comes first. If a maintainer needs more time and is actively working on a fix, we extend the deadline.

Our findings tracker shows every report we've made. While a finding is in disclosure it shows only the project and the date we reported it; the details appear once it's public.

Why we're doing this

ALSoftworks builds tools that find weaknesses before attackers do. Groundwork points that work at the code everyone shares. AI makes finding bugs faster for everyone, including attackers, so the people who maintain the foundations need help keeping up.

For maintainers

If you maintain an open-source project and want us to take a look, or if you've received a report from us and have questions, we'd like to hear from you. Our maintainers page explains how we work and how to reach us.