Report suspected vulnerabilities in any O'Shaughnessy Lab product privately to [email protected].
Encrypting your report
For confidential details, encrypt your mail to the security team's PGP key:
- Fingerprint:
367EA3D227DBD07894F47A378D65CACD093C39C9 - Public key: https://keys.openpgp.org/vks/v1/by-fingerprint/367EA3D227DBD07894F47A378D65CACD093C39C9
Verify the fingerprint against this page before trusting the key. If keys.openpgp.org is unreachable, the same key is also published at https://github.com/oslabteam.gpg, and the Lab's other public keys, including the support key used for support bundles, are at https://github.com/oslabteam.keys.
What to include
The affected product, revision or version, the impact, and reproduction details where possible.
Rules
Do not disclose vulnerabilities in public issues or pull requests.
No fixed response time or fix deadline is promised. A per-product security-maintenance policy is recorded in the product's repository when one exists.
For vulnerabilities in upstream Talos Linux rather than O'Shaughnessy Lab's fork, follow the upstream security policy.