Report a security event

Seen something we have not covered? Tell us. Spotted a mistake in an entry? Tell us that too. All you need is a GitHub account and a link to the primary source.

A new event

A vulnerability, an emergency patch or an attack in the wild. Name the affected package and versions. Link the vendor or project that owns the fix.

Open the report form

A correction

A wrong version, a dead link, or a fix that has shipped since we wrote it up. Give the entry id and the source that shows the right answer.

Open the correction form

Both forms open a public issue on GitHub. Leave out credentials, private code and personal data.

How a report is checked

Nothing goes into the feed on one person's word.

  • Two primary sources. We confirm a report with the vendor or project that owns the fix, plus one more record that stands on its own, such as the CVE entry or the upstream commit. Press coverage helps us find events. It is never the source.
  • We reproduce it where we can. If an affected range or a fixed version can be tested, a maintainer tests it before the entry goes out. If it cannot be tested, the entry says what it rests on.
  • Every change is dated. A correction is added to the entry as a dated update. You can see what changed and when.

How fast

We aim to reply on the issue within two business days. A critical event with a fix from the vendor is checked the same day. If we decline a report, we say why on the issue.

Credit

Tick "Credit me" on the form and type the name you want shown. That name goes on the entry and into the feed. A name only. No email and no profile link. Leave it unticked and your name appears nowhere on our site. The GitHub issue itself stays public either way.

A flaw in DeepSweep itself

Please keep it out of a public issue. Email security@deepsweep.ai instead.

All advisories