If you discover a security vulnerability in Open Component Model projects, please report it responsibly through one of the channels below. Do not open a public issue for security vulnerabilities.
To help us assess and address the vulnerability efficiently, please include:
- Affected component(s) and version(s)
- Steps to reproduce the vulnerability
- Impact assessment — what an attacker could achieve
- Whether the vulnerability is already publicly known
- Any suggested fix or mitigation (optional)
Please use GitHub's built-in private vulnerability reporting:
- Navigate to the Security tab of the repository.
- Click Report a vulnerability.
- Fill in the details and submit.
For more information, see Privately reporting a security vulnerability.
You may report vulnerabilities via email to the Technical Steering Committee at open-component-model-tsc@lists.neonephos.org.
The Technical Steering Committee (TSC) collectively serves as the security contact for Open Component Model projects.
Security updates are provided for the latest three minor releases (y, y-1, y-2).
| Version | Supported |
|---|---|
| Latest 3 minors (y, y-1, y-2) | Yes |
| Older minors | No |
This project follows the NeoNephos Security Guidelines for vulnerability handling. In summary:
- Initial response: We will respond to your report within 14 calendar days of receipt, in line with the OpenSSF Best Practices requirement.
- Embargo: Vulnerability details will remain confidential for up to 90 days from report receipt while a fix is developed, consistent with the Google Project Zero disclosure policy.
- Disclosure: Once a fix is available (or the embargo expires), we will publish a security advisory with full details.
| Severity | CVSS Score | Fix Target | Disclosure Target |
|---|---|---|---|
| Critical | 9.0 – 10.0 | ≤ 14 days | ≤ 30 days |
| High | 7.0 – 8.9 | ≤ 30 days | ≤ 60 days |
| Medium | 4.0 – 6.9 | ≤ 90 days | ≤ 90 days |
| Low | 0.1 – 3.9 | Best effort | Best effort |
These are SHOULD-level targets as defined by the NeoNephos Security Guidelines. The 90-day embargo ceiling is a MUST aligned with Google Project Zero. All timelines are measured from report receipt (Day 0); fix and disclosure may occur simultaneously.
We follow coordinated disclosure. We ask that you:
- Allow us reasonable time to investigate and address the vulnerability before public disclosure.
- Do not exploit the vulnerability beyond what is necessary to demonstrate the issue.
- Do not access or modify data belonging to other users.
We are committed to crediting reporters in our security advisories unless you prefer to remain anonymous.
CRA stewardship: This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described above, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project's emergency security reporting mechanisms as appropriate.
CRA Steward Contact: steward@linuxfoundation.org
Commercial Intent: Open Component Model software is designed and intended for use in commercial contexts.
For more information, see the NeoNephos Security Guidelines §11.
Published advisories are listed per repository in the repository's
Security → Advisories tab. Direct link (replace <repository> with the repository in question,
e.g. open-component-model):
https://github.com/open-component-model/<repository>/security/advisories?state=published
For deeper understanding of OCM's security architecture and design:
- Secure Design — OCM's security design principles and mechanisms, traceable to architecture decision records and source code.
- Security Assurance Case — Structured assurance case mapping identified threats to implemented mitigations with evidence links.
Note: These are contributor and auditor documents, not end-user documentation.