Security and privacy
Responsible disclosure
If you find a problem in Archipelago code, a published tool, or this site, we want to hear it privately first, and we will credit you.
How to report
Use GitHub's private vulnerability reporting on the project repository: report a vulnerability. It is enabled, it is private to the maintainers, and it needs only a GitHub account. Include what you found, how to reproduce it, and what you think the impact is. Do not include customer data.
What we do
- Acknowledge within 72 hours.
- Confirm or ask for more detail within 7 days.
- Fix, release, and publish an advisory, with a CVE where applicable, in coordination with you on timing. Our default is 90 days or the release, whichever is first.
- Credit you in the advisory unless you ask us not to.
Scope
In scope: Archipelago code in the project repositories, its releases, and this website. Out of scope: vendor platforms (Niagara, Metasys, and others), which are governed by their vendors' terms and their own disclosure programs; third-party services we do not operate.
Please do not
- Test against a building you are not authorized to operate.
- Access, modify or exfiltrate data that is not yours.
- Run denial-of-service tests against anything.
Incident response
If a vulnerability affects a hosted service (none exists today) or a release: contain (revoke tokens, pull the release), notify affected operators within 72 hours, publish an advisory. The runbook lives in the repository as SECURITY.md.
Status: private vulnerability reporting on GitHub is live. A dedicated security mailbox will be added when the project has one; until then GitHub is the channel.