Responsible Disclosure Policy

Our Commitment

Kolega.Dev scans open source repositories to identify security vulnerabilities and help maintainers fix them before they can be exploited. We believe in responsible disclosure that protects users while respecting maintainers.

This policy outlines how we handle the discovery and reporting of security vulnerabilities in open source projects. Our goal is to work collaboratively with the open source community to improve security for everyone.

Disclosure Timeline

Respecting Repository Policies

• If a repository has a SECURITY.md file with a defined disclosure policy, we follow their timeline unless it exceeds 5 working days
• If their policy exceeds 5 working days, we use our standard timeline below

Standard Disclosure Process

For all severity levels:

• Working Day 0: Immediate private disclosure to repository maintainers
• Working Day 4: Follow-up through additional communication channels if no response received
• Working Day 6: SLA exceeded - Public disclosure and remediation PR if no response or fix available

How We Report

We will contact maintainers through the following channels, in order of preference:

1. GitHub Private Vulnerability Reporting (if enabled)
2. Security email listed in SECURITY.md
3. Repository maintainer email
4. GitHub issues (marked private/security where available)

What We Include in Reports

Each vulnerability report contains:

• Vulnerability description and type
• Affected versions
• Steps to reproduce
• Potential impact
• CVSS severity score
• CWE/CVE references where applicable
• Recommended fix (when possible)
• Our disclosure deadline

Public Disclosure

After the disclosure timeline expires without resolution, we will:

• Publish a security advisory with technical details
• Submit a pull request with a proposed fix
• Notify relevant security databases (CVE, etc.)
• Update our platform to alert users of affected repositories

What We Will NOT Do

In conducting our security research, we commit to the following restrictions:

• Exploit vulnerabilities for any purpose other than verification
• Access, modify, or delete user data
• Disrupt repository operations
• Share vulnerability details with anyone except the maintainers before disclosure
• Disclose vulnerabilities that are already public

Safe Harbor

We conduct our security research in good faith to improve open source security. We request that maintainers:

• Not pursue legal action against Kolega for good-faith security research
• Work with us collaboratively to address findings
• Notify us if we inadvertently cause any disruption

Exceptions & Extensions

We may grant timeline extensions for:

• Complex fixes requiring architectural changes
• Coordination with multiple dependencies
• Documented maintainer circumstances (vacation, emergency, etc.)

To request an extension, please respond to our initial disclosure within 7 working days with details about the circumstances requiring additional time.

Scope Limitations

Contact Information

If you're a maintainer with questions about our policy or a reported vulnerability:

For general inquiries about Kolega.Dev or our services, please contact us at contact@kolega.ai

Company Information