<!--
  SPDX-License-Identifier: Apache-2.0
  SPDX-FileCopyrightText: 2026 The Gleam contributors
-->

# Incident response plan

## Stages

### 1. Triage

We monitor GitHub advisories, GitHub issues, the Gleam Discord, and emails to
security@gleam.run for security reports and bugs that may have security
implications.

If we spot a bug or report that looks like a security risk, we treat it as an
incident.

### 2. Assessment

First we verify the accuracy of the report and evaluate its impact.

The security team of the Erlang Ecosystem Foundation may be contacted for
assistance.

### 3. Response

Within 3 days of the report, we will acknowledge it, privately if the
vulnerability is sensitive. We follow a 90-day disclosure timeline.

A fix will be privately developed and backported to currently active versions
of the project.

### 4. Communication

If the issue is confirmed as a vulnerability, we will open a GitHub Security
Advisory that will be published at the same time as the fix for the
vulnerability.

The advisory will detail the vulnerability and provide a way for users to
determine if they are impacted by the vulnerability.

### 5. Recovery & Hardening

After fixing the issue, we review the circumstances that led to the
vulnerability and
evaluate what we could improve in our systems and processes to prevent similar
vulnerabilities in future.

## Responder checklist

1. Acknowledge the vulnerability by replying to the reporter. (3 day deadline)
2. Add the [Erlang Ecosystem CNA team](https://cna.erlef.org/contact) to the
   GitHub vulnerability report as collaborators.
  - [`IngelaAndin`](https://github.com/IngelaAndin) – OTP Core Contributor
  - [`maennchen`](https://github.com/maennchen) – CISO, EEF
  - [`voltone`](https://github.com/voltone) – Bram Verburg – Security WG Chair
3. Test the vulnerability and have any discussion about the details in the report comments.
4. Prepare a fix in a **private** branch.
5. The EEF team fills in the details of the report.
6. Resolve the vulnerability by doing these steps concurrently:
  1. Merge fix.
  2. Publish CVE on GitHub.
  3. Release fixed version.
