nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
1<!--
2 SPDX-License-Identifier: Apache-2.0
3 SPDX-FileCopyrightText: 2026 The Gleam contributors
4-->
5
6# Incident response plan
7
8## Stages
9
10### 1. Triage
11
12We monitor GitHub advisories, GitHub issues, the Gleam Discord, and emails to
13security@gleam.run for security reports and bugs that may have security
14implications.
15
16If we spot a bug or report that looks like a security risk, we treat it as an
17incident.
18
19### 2. Assessment
20
21First we verify the accuracy of the report and evaluate its impact.
22
23The security team of the Erlang Ecosystem Foundation may be contacted for
24assistance.
25
26### 3. Response
27
28Within 3 days of the report, we will acknowledge it, privately if the
29vulnerability is sensitive. We follow a 90-day disclosure timeline.
30
31A fix will be privately developed and backported to currently active versions
32of the project.
33
34### 4. Communication
35
36If the issue is confirmed as a vulnerability, we will open a GitHub Security
37Advisory that will be published at the same time as the fix for the
38vulnerability.
39
40The advisory will detail the vulnerability and provide a way for users to
41determine if they are impacted by the vulnerability.
42
43### 5. Recovery & Hardening
44
45After fixing the issue, we review the circumstances that led to the
46vulnerability and
47evaluate what we could improve in our systems and processes to prevent similar
48vulnerabilities in future.
49
50## Responder checklist
51
521. Acknowledge the vulnerability by replying to the reporter. (3 day deadline)
532. Add the [Erlang Ecosystem CNA team](https://cna.erlef.org/contact) to the
54 GitHub vulnerability report as collaborators.
55 - [`IngelaAndin`](https://github.com/IngelaAndin) – OTP Core Contributor
56 - [`maennchen`](https://github.com/maennchen) – CISO, EEF
57 - [`voltone`](https://github.com/voltone) – Bram Verburg – Security WG Chair
583. Test the vulnerability and have any discussion about the details in the report comments.
594. Prepare a fix in a **private** branch.
605. The EEF team fills in the details of the report.
616. Resolve the vulnerability by doing these steps concurrently:
62 1. Merge fix.
63 2. Publish CVE on GitHub.
64 3. Release fixed version.