If you find a vulnerability #

This page is for reporters, reviewers and creators who find a security problem while testing Exponential, or who get a tip about one from a source. The rule is simple and has no exceptions: an unfixed vulnerability is reported privately, and it does not go into a story, a video or a post until it is fixed.

Contents #

1. The rule
2. Step by step
3. What to put in the report
4. A message you can adapt
5. When a source tips you off
6. Covering it after the fix

The rule #

"Please report security issues privately by e-mail to [email protected], not in the public issue tracker or the discussions. You can expect a first answer within one business day." (SECURITY.md)

The same rule applies to advocates and partners (Security reports stay private). It also applies to you: a story, a video, a live stream or a social post is public, and publishing an unfixed problem puts every site that runs the software at risk.

Step by step #

1. Stop testing at the point where you can show the problem exists. Do not try it on sites you do not own.
2. Write down the version, the engine and the database, and the steps to reproduce (see the next section).
3. Send it privately to [email protected]. Do not open an issue, a forum thread or a chat message about it.
4. Keep it out of drafts others can see (shared documents, editing systems with wide access). Treat it like any other confidential source material.
5. Wait for the answer. SECURITY.md promises a first answer within one business day and that you will be "told whether the report is accepted or declined, and kept informed while a fix is prepared".
6. Cut any footage that shows the problem from a video or stream before it goes out.

What to put in the report #

From SECURITY.md:

"Leave out passwords, secrets and personal data" (SECURITY.md). If your test installation holds real data, do not attach it.

A message you can adapt #

To: [email protected]
Subject: Security report: <one-line description>

I am a <journalist / reviewer / creator> at <outlet>. While testing Exponential for <a story / a review>
I found what looks like a security problem. I have not published it and will not until it is fixed.

Version: <composer show output, tag or commit>
PHP: <version>    Engine: <Velocity / FrankenPHP / Apache or nginx with PHP-FPM>    Database: <name>

What an attacker can do: <one or two sentences>
Steps to reproduce:
1. ...
2. ...

I tested only on my own installation. Please tell me whether you accept the report and when a fix is
published, so I can decide whether and when to write about it.

When a source tips you off #

• Ask the source whether they have reported it to [email protected]. If not, encourage them to, or ask their permission to pass it on.
• Do not verify a tip by attacking someone's live site.
• A tip about an unfixed problem is not publishable on its own. You may later report that a fix was made, with the changelog as source.

Covering it after the fix #

Once a release contains the fix, you can write about it like any other security fix (Covering security fixes): say what the changelog says, which version fixes it, and what readers should do. Ask before naming yourself as the reporter in the project's channels, and ask the reporter before naming them in your story. The project's documents do not describe a credits or bounty program; do not imply one exists (Claims you must not make).

Related pages #

• Covering security fixes
• Embargoes and timing
• Which tracker for which report
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.