CVE Coordination — Marcelo Trylesinski

Public scope, reporting contact, disclosure policy, and advisory location for my CVE Numbering Authority application.
I am not yet a CVE Numbering Authority. I will only reserve, assign, or publish CVE IDs after authorization by the CVE Program.
Vulnerabilities in the open-source projects listed below, which I maintain.
Supported and end-of-life releases are considered case by case. I will defer to the supplier or another CNA whenever it has more appropriate scope.
Report vulnerabilities through the affected project's private reporting channel first. On GitHub, open the project's Security tab and use Report a vulnerability when available. Do not open a public issue.
If the project has no private reporting channel, or for CNA coordination, contact [email protected].
Reports are handled privately with the reporter and the affected project. I will validate the issue, identify affected versions, check for duplicate CVE records, and coordinate a fix and disclosure date with the relevant maintainers.
A fix or mitigation should be available before or at disclosure whenever feasible. Published information will include affected and fixed versions, impact, mitigations, references, and reporter credit when requested. Timelines may be shortened for active exploitation or adjusted when necessary to protect users. The current CNA Operational Rules take precedence.
Formal advisories are published through the affected project's canonical public security-advisory page and will be indexed here after disclosure. Published advisories will be readable without login.
No published advisories are currently listed.
x-built-with: astro + starlette-grade care