We take the security of Datum seriously and appreciate the community's help in reporting vulnerabilities responsibly.
Please do not open a public GitHub issue for security vulnerabilities. Instead, report a potential vulnerability privately to our Security Team at:
Our Security Team reviews and responds to third-party reports of security issues sent to this address promptly. If you believe the issue is time-sensitive or actively exploited, mark it as urgent in the subject line so we can triage it immediately.
Please include as much of the following as you reasonably can to help us remediate quickly:
- The affected component and version
- A description of the vulnerability
- Steps to reproduce (or a proof of concept)
- Any impact you were able to confirm
- Your contact information (optional)
We aim to remediate security vulnerabilities as soon as possible. For reference, our patch management policy sets an expected remediation timeline of 90 days from when a patch is available to when it is applied, and we put mitigations in place where a patch is not yet available or cannot be applied.
You can expect an acknowledgement that we received your report. We will keep you informed as we investigate and remediate.
Confirmed vulnerabilities are disclosed publicly per our incident disclosure policy: Datum publishes security bulletins publicly at our blog, and may additionally notify affected users directly for actionable incidents.
This applies to the software shipped from this repository. Note that security findings can also be reported against Datum's managed infrastructure (Datum Cloud); see our incident response policy for more details.