Report a security vulnerability

If you have found a security issue in a Gravwell system, we want to hear about it. We welcome good-faith reports made under our policy.

Where to send it

Email the Gravwell Security Team at security@gravwell.io.

The people who fix security issues read this mailbox. Do not use support channels or social media for vulnerability reports: they are not private.

If your report includes sensitive details, encrypt it with our PGP key, also on keys.openpgp.org. Fingerprint:

The key’s signing subkey signs this site’s security.txt and CSAF documents:

What to include

A good report lets us reproduce the issue without coming back to you with questions. Include:

• The affected URL, hostname, application or component, and the version if you know it.
• The type of vulnerability and what an attacker could do with it.
• Step-by-step instructions to reproduce it, with any request payloads, scripts or screenshots.
• Whether you accessed, changed or kept any data, and if so, what.
• How you would like to be credited, or that you would rather not be named.

We prefer reports in English. Short, precise reports are as useful as long ones.

What happens next

We will confirm we got your report within 10 business days and keep you updated while we investigate and fix it. The disclosure policy has the full timeline and the rules for testing. Please read it before you start.