GNOME

Program Details

GNOME asks for all security bugs in its projects to be reported through the form on its security page, which reaches a small security team, and submissions are generally acknowledged within two business days. The maintainer of the affected project handles the fix and coordinates the release. Reports stay confidential until the fix is committed to git or 90 days have passed, whichever comes first, and GNOME says it does not generally use embargoes.

Disclosure Window

90 days

Response SLA

2 business days

Security

Preferred Languages

English