Snapshot 218420
Normalized text
Scripts and page chrome removed; this is what change detection compares.
New:Introducing Socket Scanning for VS Code Marketplace Extensions.Learn more → Note: This policy explains what Socket does when we find an issue in third party code other than malware. If you believe you have found a vulnerability in a Socket technology, we encourage you to report it through our Bug Bounty Program. Socket Outbound Vulnerability Disclosure Policy Updated 28 August, 2025 Socket may occasionally find vulnerabilities in third-party code and systems, including open source software. When that happens, our priority is to see these issues promptly fixed, while making sure that those impacted are informed so that they can protect themselves, for example by deploying a patch or updating their systems. The policy outlined below explains how we handle vulnerability disclosure. Here are some of the motivations behind our policy: Fixing an issue requires close collaboration between the researchers at Socket reporting the issue and the third party responsible for fixing it. With this policy, we want to clearly and unambiguously explain our expectations when we report issues we find in third-party code and systems. We also make clear when Socket will disclose these issues. Not all bugs are equally sensitive. A high-impact vulnerability requires much more care before it is publicly disclosed, or may require us to deviate from our standard policy. Vulnerability Disclosure Policy Socket will attempt to contact the appropriate responsible party, like an owner, author, distributor, or maintainer of the third party code containing a vulnerability, and inform them as quickly as reasonably possible of a vulnerability we've found. We expect the third party to respond within 21 days to let us know how the issue is being mitigated to protect the impacted people. If we don't hear back within 21 days after reporting, or if an appropriate party could not be found, Socket reserves the right to disclose the vulnerability. If within 90 days after reporting there is no effective fix or credible update indicating the issue is being addressed in a reasonable manner, Socket will disclose the vulnerability. If one of these periods is set to end on a weekend or holiday known to be observed by Socket or a third party contact, the relevant period will end on the next working day. We will adhere to the vulnerability disclosure steps and the proposed timelines whenever reasonably possible, but we can envision scenarios where there might be deviations. If Socket determines that disclosing a vulnerability in third party code or systems sooner serves to benefit the public, Socket's customers, or potentially impacted people, we reserve the right to do so. Reporting Socket will make a reasonable effort to find the right contact for reporting a vulnerability, such as an open source project maintainer. We will take reasonable steps to find the right way to get in touch with them securely. For example, we will use contact methods including but not limited to emailing security reporting emails (security@ or secure@), filing bugs without confidential details in bug trackers, or filing support tickets. The contact should acknowledge the report as soon as reasonably possible. The contact should confirm whether we've provided sufficient information to understand the reported problem. In its report, Socket will include a description of the issue found, a statement of Socket's Vulnerability Disclosure Policy, and the expected next steps. If needed, Socket will provide additional information to the contact to aid in reproducing the issue. If we do not receive a response within 21 days from a contact acknowledging the report of a vulnerability, we will assume that no action will be taken. We then reserve the right to disclose the issue. For purposes of the disclosure timeframe: If Socket was able to identify an appropriate contact, Socket sending the report constitutes the start of the process. If Socket was unable to find an appropriate contact, beginning the search for a contact constitutes the start of the process. Socket will generally decline to sign non-disclosure agreements specific to an individual vulnerability or issue that we have reported. Mitigation & Timeline Whenever appropriate, Socket will work with the responsible contact to establish the nature of the issue and potential fixes. We will share relevant technical details to help expedite the fix. The contact should be as transparent as possible about the mitigation progress. They are expected to make reasonable effort to fix the reported issue within 90 days. Socket will coordinate the disclosure with the availability or rollout of the fix. If no fix is forthcoming at the 90-day mark, we will notify the contact of our intent to disclose the reported issue. If there are no mitigating circumstances, we will disclose the issue as soon as we are reasonably able to do so. Disclosure Depending on the nature of the problem, there may be a number of disclosure paths: we may disclose the vulnerability publicly, or; we may disclose it directly to the people using the project, or; we may issue a limited disclosure first followed by a full public disclosure. Socket will work with the contact to determine which approach is most appropriate in each case. Our intent is to disclose vulnerabilities in a way that is most helpful to the community. For example, we may include guidance on workarounds, methods for validating patches are in place, and other material that helps people contain or remediate the issue. We may choose to include a timeline to document communication and remediation actions taken by both Socket and the third party. Where reasonable, our disclosure will include suggested steps for mitigating actions. We will include a CVE when available, and, if necessary, issue an appropriate CVE. Additional Disclosure Considerations Here are some potential scenarios when Socket may deviate from our 90-day requirement: If the issue is actively being exploited or is in some way particularly sensitive or high-impact. In such cases, disclosing may help people protect themselves more than not disclosing the issue. If Socket believes its contact is not acting in good faith, or is in some way compromised. If a fix is ready and has been validated, but the project owner unnecessarily delays rolling out the fix, we might initiate the disclosure prior to the 90-day deadline when the delay might adversely impact the public. If a project's release cycle dictates a longer window, we might agree to delay disclosure beyond the initial 90-day window, where reasonable. Socket will evaluate each issue on a case-by-case basis based on our interpretation of the risk to people. We will strive to be as consistent as possible in our application of this policy. Nothing in this policy is intended to supersede other agreements that may be in place between Socket and the third party, such as our platform policies or contractual obligations.