SECURITY REPORT

We take security very seriously. If you have discovered a security vulnerability in one of our projects and you would like to report it to us, you can send an encrypted message to our Security Entry Point at sep@nlnetlabs.nl. We do not pay out bug bounties.

To encrypt your message, GnuPG is available as free and open source software.

Please allow us a reasonable timeframe to formulate a response and do not send security issues to public lists. If desired, we will fully credit the reporter.

If a flaw is found we intend to provide security patches, for free, to the general public. In addition, we strive to be transparent about the nature, cause and impact of security flaws. Since the announcement of a security flaw may trigger the creation of exploits, we strive to balance transparency about flaws with the impact exploits might have on the Internet and its users.

We will follow specific internal guidelines, though circumstances may force us to not apply this policy in full. End of support for the software by NLnet Labs will be publicly announced two years in advance. All security vulnerabilities will be identified with dedicated CERT vulnerability tracking numbers.

In general, the security patches are distributed according to the following priority:

Customers with a Gold support contract and the party that reported the vulnerability, under non-disclosure
Special Interest groups, under non-disclosure. These are entities that operate our project in an environment that is critical to the general public, as well as known Open Source platform Operating System maintainers
Customers with a Silver support contract, under non-disclosure
Customers with a Bronze support contract, under non-disclosure
The general public

With regards to these five groups, we will take the following considerations:

The time scale on which publish/distribute security patches differently depending on the nature of the security issue. If the issue is widely known or exploited at the moment we have developed a patch (zero day) we intend to release the patch as soon as possible to the widest audience possible, which collapses stages 1 through 5 above to the order of days.
If the issue is not yet public, we intend to release security patches to the general public on a short timescale, in the order of weeks.
If we cannot find a fix for the security vulnerability, we obviously cannot provide code and may seek assistance. In order to prevent zero-day exploits information about (the existence of) these types of vulnerabilities may only be shared under non-disclosure with category 1, and if circumstances dictate with category 2.
We provide patches for the latest released software version i.e. the latest major, minor, patch level release.
In general, we provide support for the previous major release for one year after its deprecation. We therefore also provide security patches for major releases from one year past. A major release is the increment in the first version number.

Please keep in mind that our projects are made available under the BSD or Mozilla public license and come with ABSOLUTELY NO WARRANTY.

Scope and rewards

If you have bug report without security impact, please use the public issue tracking available for each project on GitHub. Feedback about our website, or any other feedback can be sent to us via labs@nlnetlabs.nl.

We are a non-profit organisation dedicated to creating and maintaining open source software for the community, completely free of charge, and warmly welcome any reports of vulnerabilities for our software. We do not offer monetary compensation for your report, nor do we offer a bug bounty program. We do credit reporters when releasing fixes.

OpenPGP key

The OpenPGP key can be copied from below or downloaded here.

Key ID: BAE5 570A 6390 ADE6
Fingerprint: 9461 F444 EAC6 A4FE E985  BEC6 BAE5 570A 6390 ADE6
User ID: NLnet Labs security G2 <sep@nlnetlabs.nl>