github.com/ydb-platform/ydb-go-sdk/v3@v3.57.0/SECURITY.md (about)

     1  # Security Policy
     2  
     3  ## Reporting a Vulnerability
     4  
     5  We're extremely grateful for security researchers and users who report vulnerabilities they discovered in YDB. All reports are thoroughly investigated.
     6  
     7  To report a potential vulnerability in YDB please email details to [security@ydb.tech](mailto:security@ydb.tech).
     8  
     9  ### When Should I Report a Vulnerability?
    10  
    11  - You think you discovered a potential security vulnerability in YDB
    12  - You are unsure how a vulnerability affects YDB
    13  
    14  ## Security Vulnerability Response
    15  
    16  Each report is acknowledged and analyzed by YDB maintainers within 5 working days.
    17  We will keep the reporter informed about the issue progress.
    18  
    19  ## Public Disclosure Timing
    20  
    21  A public disclosure date is negotiated by YDB maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a mitigation is available for YDB users. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.