Coordinated vulnerability disclosure policy of TO COMPLETE
TO COMPLETE welcomes reports of potential vulnerabilities in its products, including in third-party and open-source components they contain. This policy says how to report one and what we do with it.
Scope
This policy covers: TO COMPLETE.
How to report
- Report to: TO COMPLETE. This is our single point of contact for vulnerability reports.
- Please include the product and version, a description of the issue, the steps to reproduce it and any proof of concept, and how we can reach you.
- You may report in English or in the language of your choice; you may stay anonymous, though we then cannot keep you informed.
What we do
- We acknowledge your report within 5 working days and keep you informed until it is resolved.
- We assess the report, and address and remediate a confirmed vulnerability without delay, in relation to its risk.
- We agree a disclosure date with you. Please do not disclose the vulnerability before a fix is available or that date has passed.
- Once a security update is available, we publish information about the fixed vulnerability: a description, the products affected, its impact and severity, and how users can remediate it. Where the security risks of publication outweigh its benefits, we may delay publication until users have had the possibility to apply the update.
- Where the vulnerability is in a component made or maintained by someone else, we report it to them.
- With your agreement, we credit you when we publish.
About this policy
Published at TO COMPLETE. Last updated TO COMPLETE.