Security acknowledgements
Thank you to the people who told us first.
Nobody has been credited yet. No one has reported a security problem in Declarable to us so far, so this list is empty — it is not shortened, and no report has been left out of it.
We would rather say that than show you a list. When somebody reports something and asks to be named, their name appears here.
How to be credited here
- Send your report to security@declarable.io, and say in it that you would like to be credited.
- Tell us the name or handle you want us to use, and a link if you want one. We print what you give us.
- We add your name after the problem is fixed, with one line saying what you found. We will show you that line before it goes up.
- You do not have to be named. Saying nothing means we credit nobody, and asking us later to take your name down is enough — we do it and we do not ask why.
- The line never carries enough detail to repeat the problem. Customers run older builds for a long time after we ship a fix.
What we promise a reporter in return is on our security page, in full on the disclosure policy page, and in the standard format in our security.txt.
Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.