The Black Duck Vulnerability Disclosure Process is executed by the Product Security Incident Response Team (PSIRT). The Black Duck process is based on well-known industry standards, such as NIST-SP-800-61, ISO 29147, and ISO 30111.

The Black Duck PSIRT coordinates the response and, if necessary, disclosure of security incidents related to Black Duck products and associated software. Black Duck PSIRT's primary objective is to minimize the risks associated with security incidents in a timely, secure, and responsible manner.

Black Duck will investigate all reports for Black Duck products/platforms that are currently supported; accepted reports will be prioritized based on severity and other environmental factors. 

If you believe you have found a security vulnerability in any repository that meets Black duck's definition of a security vulnerability, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them to the Black Duck PSIRT team through email [email protected].

Contact Black Duck within 24 hours if you encounter any end user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to Black Duck.

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

• Affected Product/Platform and Version
• Technical description of the issue
• Detailed steps to reproduce and/or sample code used to exploit the vulnerability
• Contact information and optional name for acknowledgments
• Proposed disclosure plans This information will help us triage your report more quickly.

We prefer all communications to be in English.

Black Duck follows the principle of Coordinated Vulnerability Disclosure.