Vulnerability Disclosure
"How we receive, fix, and communicate security vulnerability reports."
Why this exists
Vulnerability reports are time-sensitive. Handling them slowly or in public makes them incidents. Handling them silently risks losing the reporter's cooperation. We patch fast and coordinate disclosures.
Operational Flow
Intake: Monitor security@kryft.com. Send an automated acknowledgment within two hours. Do not let reports sit.
Triage: Let the project lead assign a severity rating (Critical, High, Medium, Low) within 24 hours.
Embargo: Keep Critical and High reports confidential between Kryft and the reporter until the patch is live.
Fix timeline: Patch Critical issues in 72 hours, High in 7 days, and Medium in 30 days. Log Low issues in Linear.
Disclosure: Give the reporter a 7-day notice before public updates. Credit them in the changelog if they agree.
Client notification: Alert affected clients before public disclosure with a summary of the issue and the patch.
Postmortem: Write a postmortem for Critical and High issues to fix the underlying process.
What good looks like
- A reporter receives an automated reply at midnight, and a detailed severity assessment by 9am.
- A critical bug is triaged, patched, and deployed within 48 hours, and the reporter is credited.
- A postmortem for a SQL injection report leads to an immediate query audit across the codebase.
What NOT to do
- Don't delay acknowledging a report because the fix is complex.
- Don't discuss an unpatched vulnerability in public or unmonitored channels.
- Don't ignore low-severity reports. Small bugs can be chained to create critical exploits.
Security researchers who report vulnerabilities responsibly are helping you. They could sell the bug or exploit it. Instead, they emailed you. The correct response is speed and appreciation, not legal threats. Organizations that respond to good-faith disclosures with cease-and-desist letters usually end up as case studies in bad PR. We treat every report as legitimate until proven otherwise.
The embargo window protects clients. Once the patch is live, we share the details openly. Researchers who get credit and clean resolutions become allies. Act within the timelines, patch fast, and say thank you.