Security / Disclosure
Vulnerability disclosure policy
Effective 3 September 2026
AutoVuln reports confirmed vulnerabilities to the organisation that can fix them. This policy sets clear deadlines while keeping technical details private during remediation.
Scope
This policy covers vulnerabilities that AutoVuln finds and reports in third-party products or open-source projects.
The goal is to give maintainers time to produce a complete fix while giving users and downstream projects a clear view of the remediation timeline.
Private report
AutoVuln first sends the responsible vendor or project a private technical report. The report identifies the affected product, describes the security impact, provides supporting evidence where safe, and states the disclosure deadline.
AutoVuln uses the recipient's documented security contact or private issue-reporting process where one is available. Technical details remain restricted during the coordination period.
Reporting transparency
Within approximately one week of reporting a vulnerability to a vendor or open-source project, AutoVuln will publicly share that a vulnerability was discovered. We will share:
- the vendor or open-source project that received the report;
- the affected product;
- the date the report was filed and the date when the 90-day disclosure deadline expires.
The status entry will not include a technical description, proof-of-concept code, or other information that would materially help an attacker find or exploit the vulnerability.
AutoVuln publishes these notices in the reporting transparency register.
Standard disclosure deadline
The standard deadline is 90 calendar days after AutoVuln sends the initial report.
If a fix becomes available to users before the deadline, AutoVuln will publish the technical details 30 days after the fix becomes available. AutoVuln and the recipient can agree to publish sooner, such as when publication aligns with a security advisory.
If a fix is not available by the deadline, AutoVuln will publish the technical details when the deadline expires.
Grace period and exceptional cases
AutoVuln may grant a grace period of up to 14 days when the recipient commits to release a fix within that period. If the recipient releases the fix during the grace period, technical disclosure will still occur no later than 120 days after the initial report.
If a deadline falls on a weekend or public holiday in Luxembourg, AutoVuln may move it to the next business day.
AutoVuln may bring a deadline forward or move it back in exceptional circumstances. Any change will consider user safety, credible remediation work, active exploitation, and the risk created by disclosure. AutoVuln will record the reason in the public status entry when it is safe to do so.
Active exploitation
A vulnerability that is being actively exploited uses a 7-day deadline. This period gives the recipient time to release a fix or publish practical mitigation advice.
If neither a fix nor useful public advice is available when the 7-day deadline expires, AutoVuln may publish enough information to help users protect themselves.
When a vulnerability is fixed
A vulnerability is fixed when the vendor or project makes a correction available to affected users. An internal fix that users cannot obtain does not close the disclosure timeline.
When a public source-code change reveals the vulnerability, AutoVuln may treat that change as public disclosure and discuss the issue before a packaged release is available.
Public record
The reporting transparency register lists each public status notice. AutoVuln updates an entry when the vulnerability is fixed, the deadline expires, or the disclosure status changes.