Responsible disclosure
Found a vulnerability in grith? Here's how to report it.
If you have found a security vulnerability in grith, please report it privately rather than opening a public issue. We take security reports seriously and acknowledge every one.
How to report
The preferred route is GitHub private vulnerability reporting: go to github.com/grith-ai/grith/security/advisories, click Report a vulnerability, and fill in the details. The report stays private until a fix is available.
Otherwise, email security@grith.ai with:
- A description of the issue.
- Steps to reproduce (a working exploit is helpful but not required).
- Affected versions.
- Your assessment of impact.
- Whether you would like to be credited in the advisory.
There is no published PGP key. If you need to encrypt the report, ask for one at that address.
What you can expect
| When | What |
|---|---|
| Within 48h | Acknowledgement that we have received the report. |
| Within 5 business days | Initial triage - confirmed, duplicate, or needs more information. |
| Per the fix complexity | Patch development, often with you in the loop. |
| Within 90 days | Public disclosure if a fix has shipped, or sooner if you prefer. |
We coordinate disclosure timing with you. A CVE is filed for confirmed vulnerabilities that warrant one.
Scope
In scope:
- The grith binary and every crate in it - proxy filters, supervisor, audit chain, digest queue, API server, provider-key encryption, canary tokens, configuration handling.
- The local dashboard and the team dashboard at grith.ai.
- The Pro services - licence refresh, team sync, analytics.
- The grith-docs site, for issues that affect user safety such as link-redirect attacks.
Out of scope:
- The grith.ai marketing site where no user data or auth is involved.
- Third-party dependencies. Report those to their maintainers; we track them via Dependabot.
- Social engineering.
- Denial of service by resource exhaustion against a loopback-bound local server.
- Self-XSS, theoretical issues with no working proof of concept, missing best-practice headers on pages without auth.
Bug bounty
grith does not run a bug bounty. Confirmed reports are credited in the release notes and the changelog unless you would rather stay anonymous, and for high-severity findings (CVSS 7 and above) we consider a discretionary reward.
What not to do
Please do not:
- Test against grith.ai infrastructure beyond the minimum needed to verify a finding.
- Test against other people's grith installs without their explicit authorisation.
- Publicly disclose the finding before we have had a chance to ship a fix.
See also
- Advisories - where fixes are published.
- Limitations - known limits are not vulnerabilities.
- Threat model