Policy
Coordinated disclosure policy
How Tracewire Security reports the vulnerabilities it finds, and when it publishes them.
[PLACEHOLDER: policy review: owner to confirm every term on this page, including timelines and exceptions, and set the effective date]
Summary
- We report vulnerabilities privately to the vendor or maintainer first.
- We publish details 90 days after the initial report, or when a fix is released, whichever comes first.
- We keep the vendor informed of our publication plans and share advisory drafts in advance.
Scope
This policy applies to vulnerabilities that Tracewire Security discovers through its own independent research. Findings from client engagements are confidential to the client and are handled under the terms of that engagement.
How we report
- Finding a contact. We look for the vendor's published security contact: a
security.txtfile, a security page, a product security team address, or a bug bounty or disclosure program. - Initial report. We send a report with a description of the issue, the affected product and versions, steps or code to reproduce it, and our assessment of impact. The report states the planned disclosure date.
- Secure channel. We send technical details over an encrypted channel where the vendor offers one. Our PGP key is at /pgp-key.txt.
- No response. If we receive no acknowledgment, we try again through other published contacts. If the vendor still cannot be reached, we may ask a coordinator such as CERT/CC to help. The timeline continues to run from the first report.
Disclosure timeline
| When | What happens |
|---|---|
| Day 0 | We send the initial report to the vendor. The 90-day period starts. |
| Day 0 to 90 | We answer questions, review proposed fixes on request, and agree a publication date with the vendor. |
| Fix released | If a fix ships before day 90, we publish after the release, normally allowing time for users to update. |
| Day 90 | We publish an advisory, whether or not a fix is available. |
Exceptions
- Extensions. If a vendor is actively working on a fix and gives a specific release date shortly after day 90, we will consider a short extension. Requests should reach us before the deadline.
- Active exploitation. If we have evidence that a vulnerability is being exploited, we may publish sooner, with enough detail for defenders to act.
- Already public. If the details become public through another source, we may publish immediately.
What we publish
Advisories appear on our advisories page. An advisory normally includes a description of the issue, affected and fixed versions, the CVE ID if one is assigned, remediation or mitigation guidance, and the disclosure timeline. We share a draft with the vendor before publication and correct factual errors they identify.
Where a CVE ID is appropriate and the vendor does not assign one, we request one through the relevant CVE Numbering Authority.
Communication
- We communicate with vendors by email at contact@tracewiresecurity.com.
- We do not ask for payment as a condition of reporting, withholding, or delaying publication of a vulnerability.
- We do not share unpublished vulnerability details with third parties, other than a coordinator where one is needed to reach the vendor.
- We ask vendors to credit Tracewire Security in their own advisories.
Research conduct
We carry out research on systems and products we own, are licensed to use, or are authorized to test. We avoid accessing, changing, or retaining data that is not ours, and we do not degrade services used by others.
Contact
Questions about this policy, or about a report you have received from us: contact@tracewiresecurity.com.
Effective date: [PLACEHOLDER: policy effective date]