Report a vulnerability¶
Edition: Community and Enterprise
Do not open a public issue, pull request or discussion for a vulnerability.
Report it privately: on the sealfix repository, open Security, then Report a vulnerability. Only the maintainers see the report.
Please include:
- the sealfix version (
sealfix --version, or the image tag and digest); - the component (API, executor, notifier, gitsync, SIEM exporter, CLI) and the database engine, if a target is involved;
- how to reproduce it, and what an attacker gains;
- whether you believe it is being exploited.
Never include real customer data, real credentials or a production database's contents. Fake values are enough to show a leak.
What happens next¶
These targets are provisional until the first release.
| Step | Target |
|---|---|
| We acknowledge the report | Within 3 business days |
| We confirm or dispute it, and agree a severity (CVSS 4.0) | Within 10 business days |
| A fixed release for Critical and High | Within 30 days of confirmation |
| A fixed release for Medium | Within 90 days |
| Low | In a regular release |
We keep you informed until the fix ships, and credit you in the advisory unless you ask us not to. Please keep the report private until the advisory is published, or for 90 days, whichever comes first.