Report vulnerabilities privately.
Send the initial report to security@octetkeep.com. Do not use public issues, discussions or pull requests for an uncoordinated vulnerability report.
LOCAL FORENSIC WORKSPACE · ZERO TELEMETRY
Report vulnerabilities privately.
Use the dedicated security intake channel for coordinated vulnerability disclosure without placing secrets or customer forensic artifacts on public collaboration surfaces.
Send enough to reproduce, not unrelated evidence.
Include the affected version and product surface, reproduction steps, observed security impact and contact details if you want a response.
Keep secrets and customer artifacts out of the initial report.
Do not include credentials, raw secrets, private keys, production environment values or unrelated customer forensic artifacts. Coordinate sensitive evidence after initial contact when genuinely necessary.
TRIAGE / GOVERNED
Severity, acknowledgement and reporting decisions are separate records.
The SECURITY_RESPONSE_OWNER triages each report. Severity considers impact, exploitability, scope and affected versions. Receipt acknowledgement is required after intake review, but this public channel does not create a fixed response-time SLA.
CHANNEL = security@octetkeep.com INITIAL_INTAKE = PRIVATE PUBLIC_ISSUE_REPORT = DENY TRIAGE_OWNER = SECURITY_RESPONSE_OWNER ACKNOWLEDGEMENT = REQUIRED FIXED_PUBLIC_RESPONSE_SLA = NONE CUSTOMER_FORENSIC_ARTIFACTS = DENY_BY_DEFAULT
EVIDENCE / BOUNDARY
Published route ≠ proven human delivery.
The operational evidence confirms that the published recipient route was accepted by the mail server. That does not prove human handling or end-to-end delivery of any particular report.
Read the coordinated disclosure policy.
The legal disclosure policy defines the good-faith research and confidentiality boundary; this page defines the operational reporting path.