Security
How to report vulnerabilities in OTF projects, and how we handle them.
Reporting a vulnerability
Please report vulnerabilities privately to security@opentechf.org rather than in a public issue. Include a description of the issue, the affected project and version, and steps to reproduce it if possible.
What to expect
We practise coordinated disclosure. A maintainer will acknowledge your report, investigate, and work on a fix; you are welcome to coordinate a public disclosure once a release is available.
Acknowledgement
Within 3 business days
Initial assessment
Within 1 week
Fix or mitigation
90-day coordinated disclosure window
Scope
This process covers the open source projects published under the Open Tech Foundation(opens in new tab) organization on GitHub. For anything else, reach out through the contact page.
We appreciate responsible disclosure and will credit reporters by name unless they prefer to remain anonymous.