For maintainers

What a report from us looks like

Every report is reproduced before we send it. It says which versions are affected, how to trigger the issue, what an attacker could do with it and how sure we are of that. Where we can, it comes with a proof of concept and a proposed patch. We send it privately, through your security policy or advisory process if you have one, otherwise to the contact you list for security issues.

How we disclose

We follow coordinated disclosure. We don't publish anything about an issue while you're working on it. The details become public once a fix has shipped, or 90 days after our report, whichever comes first. If you need more time and are actively working on a fix, tell us and we'll extend the deadline. If an issue is already being exploited, we'll talk to you about moving faster.

On our findings page, an issue in disclosure shows only your project's name and the date we reported it.

What we ask of you

Nothing beyond what you'd do anyway: let us know you've received the report, and tell us if you disagree with our assessment. We're happy to review a fix, test it, or write the patch ourselves if that helps.

Ask us to look at your project

If you maintain a widely used project and would like us to look at it, or you've had a report from us and have questions, write to hello@alsoftworks.dev. Tell us what the project is, where it's used, and which parts worry you most.