Please report security issues privately:
- Email: [email protected]
Do not file public GitHub issues for security problems.
When reporting, please include:
- Affected project/repo and version(s)
- Impact and component(s) involved
- Reproduction steps or PoC (if available)
- Your contact details and preferred credit name
If you do not receive an acknowledgement of your report within 6 business days, or if you cannot find a private security contact for the project, you may escalate to the OpenJS Foundation CNA at [email protected].
If the project acknowledges your report but does not provide any further response or engagement within 14 days, escalation is also appropriate.
We follow coordinated vulnerability disclosure:
- We will acknowledge your report, assess impact, and work on a fix.
- We aim to provide status updates until resolution.
- Once a fix or mitigation is available, we will publish a security advisory (and request a CVE via the OpenJS CNA when applicable).
- Reporters are credited by default unless you request otherwise.
When investigating and reporting vulnerabilities, please do not:
- Break the law
- Access or modify data beyond what is needed to demonstrate the issue
- Use high-intensity or destructive testing tools
- Attempt denial of service (DoS) attacks
- Social engineer, phish, or physically attack project members
- Publicly disclose before we release a fix or advisory
For an overview of the security assumptions, potential attack vectors, and areas of concern relevant to webpack, please refer to the Threat Model.
In the event of a broader security incident, please refer to our Security Incident Response Plan.