Responsible Vulnerability Disclosure
We take security serious. That is why we have developed TrustSource and this is why we are keen in providing our users with insights and advice on how to best handle Known Vulnerabilities within our solutions. In general you may expect us to follow the principles of the CMU Coordinated Vulnerability Disclosure Policy. Below you will find the list of Known Vulnerabilities concerning our solutions as well as our advice (via VEX).
– In case you have further questions, please feel free to send your questions to vulnerabilities@trustsource.io.
– If you want to learn how to setup such a page, go to our knowledgebase.
– If you want us to provide you such a page as a service, contact sales@eacg.de
– If you believe, you have found a vulnerability in our code, please send an eMail answering as many as possible of the following questions :
- What type of issue did you discover?
- Which source files (path) are related to the issue?
- Which source code (tag/branch/commit) is affected?
- Is a specific configuration required to reproduce the issue?
- What needs to be done, to reproduce the issue?
- Do you, by any chance, have a poc/exploit code?
- What impact does your dsicovery have from your point of view?
Please do not hesitate contacting us, even if you will not be able to answer some of the questions above! We are happy to learn about every potential weakness we oversaw. To keep your discovery private, please encrypt the message using our public key:
—–BEGIN PUBLIC KEY—–
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr+JNQ1PqtMDAxfJjeMDk
/IUbA5bM2I3P1/mjSr78cvVxWTTFFiNB1Wbs4B/sEVl/IQw5mhccO1eRORApdIrl
W/AhZjgPipsB6lx0hdyrYId7TZdivc2iSeL0DjxxoPZiayD9jbEEON62e8H8uB/r
xsAdP9y7xQEOExltVzts+nHe0YFwI6JAqUJ90KVc8FrHQLRY9zQOEJ2Vj1UkK5NC
v7CqhvH7yrsvb+byjgj13unpQo17s4kgx6vyMWbLTFWvEs3c5lJFvgbkzhOpwrPN
1rByZbo4wPR9JmamS2UXwO5XBD8iex51JYSAotgouqopSH7F10k6maOSl9/umquU
nrLHmBs6ftW9AfLddIhCajIsHA7HZNK1bvN09H0ccUzP5K30seNkfic4Tv6DGkJa
cY2KBcbBuktXvBGmceHj3ZzyreuPg/RCZ4L3BJp6g83Ok5lp0nzJOA2pPM6pMX6j
pie0wKqJVg152BB1CNy1m9uKtB33XcWm0q8UO3u6AtLechXj1OfOXVu8qrLMZQ5R
r0vF8HZhQ5+wQAlFrP85vsG67/SKHG1/suI5BHAthVHsiI69ZKHnt8aj0C0oXVXo
w6sxTYP+T7jsB62WrrPmBxf2YJ8L1j6hOh38xTPMO3qVHPtI71xLyDr9Pt6ArgAw
az5F7PBa57AfzLU60ar0qhcCAwEAAQ==
—–END PUBLIC KEY—–
Vulnerability Guidance for TrustSource Services
The TrustSource Core SBOM can beretireved at: (…)
The corresponding VEX is available at: (…)
TrustSource provides a set of scanners for different eco-systems. You may pull the SBOMs as well as the corresponding VEX documents by using the TrustSource APIs together with your API-key and the corresponding document key
- maven :
- ant:
- gradle:
- grunt:
- npm:
- pip:
- swift:
- composer:
- ms world (C, C#, etc.):
- Cmake:
To pull a SBOM of the different scanners, please use the SBOM API at (…)
To pull the latest VEX on scanners, please use the VEX API at (…).
PLEASE NOTE: you will also find the complete VEX API URL inside each SBOM and vice versa.