This policy covers the OpenCTEM sensor (binaries and the ghcr.io/openctemio/sensor images) and is part of the OpenCTEM vulnerability disclosure policy.
Do not open a public GitHub issue, pull request or discussion for a vulnerability. Report it privately through either channel:
- email security@openctem.io;
- GitHub private vulnerability reporting: Security → Report a vulnerability on this repository (it becomes a draft security advisory visible only to you and the maintainers).
Please include:
- the affected component and version (
openctemio-sensor -version, image tag or digest); - a description of the issue and its impact, and the access an attacker needs first;
- step-by-step reproduction, a proof of concept or a failing test;
- any known mitigation or suggested fix;
- how you would like to be credited, if at all.
Test only against systems you own or are authorized to test, with test data. On services we operate, use only your own accounts and organizations and never point scans at third-party systems; stop and report as soon as you reach data that is not yours. The full testing rules are in the disclosure policy below.
| Step | Target |
|---|---|
| Acknowledgement of your report | within 3 business days |
| Triage (confirmed or not, severity, next steps) | within 10 business days |
| Fix released, by severity (CVSS 3.1) | critical 7 days · high 30 days · medium 90 days · low best effort |
We follow coordinated disclosure: we keep you informed while we work on the fix, agree a disclosure date with you, and publish a GitHub security advisory with the fixed version, with a CVE identifier for a confirmed vulnerability in released software.
This is a vulnerability disclosure programme without monetary rewards. Unless you prefer otherwise, we credit you on the security acknowledgements page of the documentation, in the security advisory and in the release notes of the fixed version. Bug bounty: coming soon — a programme with rewards is planned; until it starts, no report is eligible for a reward.
Security fixes are made in the latest release. Upgrade to the latest release to receive them.
We consider security research carried out in good faith under the disclosure policy to be authorized: we will not initiate or support legal action against you, or report you to law enforcement, for it, and we waive restrictions in our terms of service that would otherwise prohibit it. Good faith means testing only systems you own or are authorized to test, avoiding privacy violations, data destruction and service disruption, and giving us reasonable time to fix the issue before any public disclosure. If in doubt, ask security@openctem.io first.
The full vulnerability disclosure policy (scope, testing rules, safe harbor): https://docs.openctem.io/security/vulnerability-disclosure/.