Vulnerability reporting

Report privately

Do not open a public Issue for vulnerabilities that could expose tenant telemetry, sessions, write keys, Source Map Artifacts or infrastructure credentials.

Prefer a private vulnerability report through the repository Security policy / advisory workflow when available. Include:

• affected component (Console, API, ingest, SDK, worker, dependency);
• OpenRUM Release or commit SHA;
• reproduction steps with minimal fixtures;
• impact assessment (confidentiality, integrity, availability);
• whether a proof of concept is included.

Never paste production Event payloads, session cookies, write keys or customer data into the report.

Severity expectations

Critical and high findings that enable cross-tenant access, auth bypass, remote code execution, or durable data loss should block production rollout until fixed or explicitly accepted by the Instance security owner. See the Threat model for trust boundaries and residual risks.

Safe disclosure

Coordinate disclosure after a fix is available on main or a patched Release. Avoid publishing exploit details before operators have a reasonable upgrade window.