Reporting a vulnerability
If you think you’ve found a security issue in Ultraviolet Observability, please tell us privately first, so we can fix it before it’s public.
How to report
Section titled “How to report”Email security@uvobservability.com with:
- The version you’re running (shown on the Updates page, or the image tag).
- What you found, and the steps or a proof of concept to reproduce it.
- What an attacker would need (access, role, network position) and what they could do.
Our machine-readable contact details are at /.well-known/security.txt.
What to expect
Section titled “What to expect”| Within | |
|---|---|
| We acknowledge your report | 2 business days |
| We confirm whether it’s a vulnerability, and how severe | 5 business days |
| A fix ships for a critical or high-severity issue | 30 days |
We’ll keep you updated while we work on it, tell you when the fix ships, and credit you in the release notes if you’d like.
Fixes and versions
Section titled “Fixes and versions”Security fixes ship in a new release. Running the latest stable release is the way to stay covered; we don’t patch older versions. With the lifecycle manager on, the Updates page shows when a newer release is out. For a serious issue we also contact customers directly.
In scope:
- Everything we ship to run in your environment: the images, the Helm charts, the portal, the sensor and the browser SDK.
- Our license service and the license files it issues.
- How we sign and distribute releases.
Out of scope:
- Issues that need an attacker to already be a cluster administrator, or root on a node.
- Findings from automated scanners without a demonstrated impact.
- Denial-of-service by flooding, and social engineering of our staff.
- Our public demo, marketing site and documentation, unless the issue would also affect a customer’s install.
Testing in good faith
Section titled “Testing in good faith”Test against an install you run yourself. Don’t access other people’s data, degrade a service for others, or keep data you come across. If you follow this page, we won’t take legal action against you for your research, and we’ll work with you on timing before anything is made public.