The TypeSafe Go community takes security seriously and follows responsible disclosure.

Email security@stacklok.com with affected versions, reproduction steps, and relevant files. Do not open a public issue. If the repository's private GitHub Security Advisory form is available, reporters may alternatively use it. For GPG-encrypted disclosure, first email to request the current public key.

Suspected vulnerabilities are handled under the Responsible Disclosure model. Immediately email the security team about an already-public vulnerability. The team will ask reporters to keep reports private until a fix is available.

Timelines are targets for private disclosures and may change with severity, development effort, upstream coordination, or public disclosure (which is handled as soon as possible).

The security team selects relevant engineers, adds them to the private advisory, and forms a Fix Team. Details, severity, and handling decisions remain in the private advisory.

The team maintains the repository advisory, records affected versions and CVSS assessment, requests a CVE when appropriate, develops and reviews the fix in the advisory's private fork, and agrees on a release date. Communication stays in private channels. A low assessed risk may justify a slower schedule.

The Fix Team and security team release the reviewed fix, publish the advisory and actionable mitigations, and announce the release, CVE, severity, and impact on the Stacklok Discord. Release timing and artifacts depend on the affected package.

Within 1–3 days after release, the team conducts a blameless retrospective covering contributors, timeline, cause, response, and improvements, and shares an appropriate summary with the Stacklok community.