Report a vulnerability

Where to send it

security@2atomic.com. One report per issue. Include the product and version or artifact digest, the platform, the steps or input, and what you observed against what you expected.

Not a public issue tracker: that starts a clock for every user before a fix exists. To encrypt, send a first message with no sensitive detail and we will send you a key.

What you get, and by when

• Three business days to acknowledge that a human has it.
• Ten business days to a triage verdict: reproduced or not, the impact, and whether it is in scope. If we could not reproduce it we say what we tried.
• Every fourteen days while it is open, without you asking.
• Ninety days from triage to a fix or a documented mitigation, faster if it is being exploited. If we will miss that, we tell you before the date, with a reason.

We never push a silent security fix. The commit says what the issue was, and the advisory credits you by name, handle, email, or as anonymous. Tell us which.

Scope

In scope: anything we build and ship, our sites and hosted services, and our build, signing and distribution path. That includes anything that would let someone publish an artifact under our identity, or make a verification step pass when it should fail.

Out of scope: another customer's own deployment, third-party services we do not control, scanner output with no demonstrated impact, social engineering, physical access, and denial of service by volume.

Reaching another customer's data through our service is in scope.

Safe harbour

Act in good faith within that scope and we will not pursue or support legal action against you, and will not report you to law enforcement.

Good faith means all five of these:

• You stayed in scope.
• You took only the minimum data needed to demonstrate the issue.
• You degraded nothing for anyone else.
• You kept and shared no one else's data.
• You told us promptly.

If a third party comes after you for research that was in scope and in good faith, tell us and we will state our position to them in writing. This policy cannot waive anyone's rights but ours. If you are unsure whether something is in scope, ask first.

No bounty

Not today. We pay in credit, a direct conversation with the engineers who own the code, and a fix that ships. If that changes, this page changes with it.

If it is being exploited

Where a vulnerability in our product is actively exploited, regulation can oblige us to notify a regulator on a clock we do not set, whatever we agreed about publication. That clock does not shorten your credit, change the safe harbour, or let us name you to anyone.

Under the EU Cyber Resilience Act it is 24 hours to an early warning, 72 hours to a notification, and 14 days to a final report.

A vulnerability we find in software we do not maintain

That is a separate commitment: our research disclosure policy.

Changes to this page

We version this page and date every change. What we committed to while a version was published applies to reports received under it; we do not retroactively narrow the safe harbour on a report in flight.