Report a vulnerability

If you have found a vulnerability in sslbrain, sslbrain Cloud (EU), sslbrain.com or FairSSL's licensing and update infrastructure, write to security@sslbrain.com. Do not open public issues, pull requests or discussions about it.

Please include

  • the affected version, commit, page or API
  • how it is deployed
  • how to reproduce it, or a proof of concept
  • what the flaw can be used for
  • logs or screenshots with sensitive data removed

Response times and disclosure

We acknowledge receipt within 5 business days and give an initial assessment within 30 days.

We ask for at least 90 days from your first report before anything is published. When we fix the flaw, we agree on a joint disclosure date. When 90 days pass without a fix or an answer from us, you may disclose at your discretion.

When a vulnerability affects our customers, it is published afterwards under security notices.

Safe harbor

FairSSL will not pursue legal action against security researchers who meet all the conditions below. This extends to the anti-circumvention, reverse-engineering and license-enforcement restrictions in the FairSSL Proprietary Source-Visible License, as long as you only identify and report vulnerabilities.

Conditions

  • Report the finding privately to security@sslbrain.com before any public disclosure.
  • Allow FairSSL at least 90 days from the first report to investigate and fix before you publish or discuss the finding.
  • Test only on your own installations or isolated test environments that you control.
  • Test only as much as it takes to confirm the vulnerability, and stop once it is confirmed.
  • Delete any data you accessed during testing as soon as you no longer need it to document the report.

Safe harbor ends with

  • extortion, or a demand for payment to keep the finding secret
  • selling or passing on knowledge of the vulnerability or exploit code to anyone else
  • publishing before the 90 days have passed without FairSSL's written consent
  • taking more data than it takes to show the vulnerability
  • making a service unavailable or slower, or destroying data, at FairSSL
  • testing on other customers' installations or environments you do not control
  • using the finding, the source code or the license's security-assessment carve-out to compare with or build a competing product

When a condition is broken, the license restrictions apply in full, and FairSSL may refer the matter to law enforcement.

This text is based on SECURITY.md in the source code at github.com/sslbrain.