Report a vulnerability

If you have found a security problem, please report it privately before disclosing it publicly.

How to report

Email security@emendant.com with "security" in the subject line. Please include:

• the output of emendant --version, if the report is about the tool;
• your operating system and Node.js version;
• what you did, what happened, and what you expected instead; and
• anything needed to reproduce it, such as a minimal repository or a request.

You will get an acknowledgement within five working days, and an assessment with a plan or a reason for declining within thirty days. There is no bug bounty. Where you would like credit for a report, say so and it will be given in the release notes for the fix.

What is in scope

• the emendant package published on npm, including the change feed inside it;
• the feed service at feed.emendant.com, including the signing and trust chain;
• the contribution intake at contributions.emendant.com; and
• this website.

Out of scope: the model providers Emendant can be pointed at, the package registries it reads, and the repositories it scans, all of which belong to somebody else. Reports about a breaking change in a provider's SDK are not security reports; those go to contact.

Testing that is welcome, and testing that is not

Test against your own machine and your own repositories freely. Please do not run load or denial of service tests against the feed service, do not try to reach other people's data, and do not use automated scanners against emendant.com. If a test needs to touch the live service in a way this paragraph does not cover, ask first at the address above.

Research carried out in line with this page is treated as authorised, and no legal action will be pursued over it.

Security documentation

Read security and privacy for how scanning, fixes, and feed downloads handle your code and data.