Incident response
Reporting a vulnerability
Email: [email protected]
PGP key: Available on request via the same address (published version coming Q1 2027).
What to include:
- Affected component (engine, gateway, UI, docs, integration)
- Affected version(s) (git commit SHA or release tag)
- Steps to reproduce, or minimal proof-of-concept
- Assessed severity per your framework (we use CVSS 3.1)
- Whether the finding was in the OSS repo or against a live customer deployment
Response SLA:
- Acknowledgment: within 1 business day
- Initial triage + severity confirmation: within 3 business days
- Fix or mitigation: severity-dependent (see below)
Severity + fix SLAs
| Severity | Description | Fix or mitigation SLA |
|---|---|---|
| Critical (CVSS 9.0+) | Remote code execution, auth bypass, secret exposure | 24 hours to mitigation, 7 days to patch release |
| High (CVSS 7.0-8.9) | Privilege escalation, PII leak, DoS | 7 days to mitigation, 30 days to patch release |
| Medium (CVSS 4.0-6.9) | Info disclosure, weak crypto, DoS with mitigation | 30 days to patch release |
| Low (CVSS <4.0) | Hardening opportunity, defense-in-depth | Next scheduled release |
Coordinated disclosure
Default window: 90 days from initial report to public disclosure.
Extensions granted:
- +30 days if fix requires coordinated release with a downstream (e.g. ClickHouse, Anthropic)
- +90 days if critical infrastructure severity and customer patch adoption is slow
Public disclosure format: CVE if applicable, a security advisory in the release notes, and customer notification email.
Customer notification during incidents
If a security incident affects a customer's data or availability:
| Deployment mode | Notification channel | SLA |
|---|---|---|
| BYOC / self-hosted | Security advisory + release-notes email | 72 hours from InfraSage confirmation |
| Managed SaaS (Q1 2027) | Direct email + status page + in-console banner | 24 hours from InfraSage confirmation |
For customers on paid support, we additionally reach out via the primary contact on file.
Hall of fame
We publicly credit security researchers who follow coordinated disclosure. Submissions accepted at [email protected] with subject hall-of-fame-add.
Scope
In scope:
- All InfraSage-authored code, as shipped in our images and releases
- Docker images published to
ghcr.io/infrasagedev/* - The InfraSage Helm chart
- The console (
console.infrasage.dev), docs (docs.infrasage.dev), and API (api.infrasage.dev) surfaces
Out of scope:
- Third-party dependencies (please report those upstream: AWS, ClickHouse, Anthropic, and so on)
- Denial-of-service attacks against our own infrastructure (test in your own environment)
- Findings requiring physical access
- Social engineering of InfraSage employees
Public transparency
Post-mortems for customer-affecting incidents (severity Medium+) will be published to status.infrasage.dev/incidents (status page shipping Q4 2026) with a 30-day cool-down before publication to allow all customers to patch.