noolstack

Coordinated vulnerability disclosure policy

Policy version: 1

Response timelines

• Acknowledge receipt: within 3 business days
• Triage: within 5 business days
• Fix target, by severity (calendar days from triage) — these are aims we work toward, not guarantees:
  • Critical: 14 days
  • High: 30 days
  • Medium: 90 days
  • Low: 180 days
• Public disclosure: within 90 days post-fix, or per coordinated agreement

Safe harbour

Researchers acting in good faith within the documented scope are covered by our published safe-harbour terms, reproduced in full below and canonically at https://noolstack.io/security/policy#safe-harbour

We commit not to pursue legal action against good-faith security research conducted under our published CVD policy. Researchers acting in good faith — testing only their own accounts or fixture data, avoiding privacy or service-availability harm, and reporting findings within the documented disclosure timeline — are protected from civil or criminal liability we would otherwise be entitled to pursue. See the full safe-harbour text at noolstack.io/security/policy#safe-harbour.

This page is generated automatically from the noolstack source repository.