nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
Reponder checklist
author
Louis Pilfold
date
(Apr 25, 2026, 6:01 PM +0100)
commit
34b4178b
34b4178b841930d52c808eeb620e74246737d5dd
parent
31ccb2fb
31ccb2fb26afe2ce51f1feae5645edf3b0413790
+23
-5
+23
-5
docs/incident-response-plan.md
+23
-5
docs/incident-response-plan.md
···
1
1
# Incident response plan
2
2
3
-
## Triage
3
+
## Stages
4
+
5
+
### 1. Triage
4
6
5
7
We monitor GitHub advisories, GitHub issues, the Gleam Discord, and emails to
6
8
security@gleam.run for security reports and bugs that may have security
···
9
11
If we spot a bug or report that looks like a security risk, we treat it as an
10
12
incident.
11
13
12
-
## Assessment
14
+
### 2. Assessment
13
15
14
16
First we verify the accuracy of the report and evaluate its impact.
15
17
16
18
The security team of the Erlang Ecosystem Foundation may be contacted for
17
19
assistance.
18
20
19
-
## Response
21
+
### 3. Response
20
22
21
23
Within 3 days of the report, we will acknowledge it, privately if the
22
24
vulnerability is sensitive. We follow a 90-day disclosure timeline.
···
24
26
A fix will be privately developed and backported to currently active versions
25
27
of the project.
26
28
27
-
## Communication
29
+
### 4. Communication
28
30
29
31
If the issue is confirmed as a vulnerability, we will open a GitHub Security
30
32
Advisory that will be published at the same time as the fix for the
···
33
35
The advisory will detail the vulnerability and provide a way for users to
34
36
determine if they are impacted by the vulnerability.
35
37
36
-
## Recovery & Hardening
38
+
### 5. Recovery & Hardening
37
39
38
40
After fixing the issue, we review the circumstances that led to the
39
41
vulnerability and
40
42
evaluate what we could improve in our systems and processes to prevent similar
41
43
vulnerabilities in future.
44
+
45
+
## Responder checklist
46
+
47
+
1. Acknowledge the vulnerability by replying to the reporter. (3 day deadline)
48
+
2. Add the [Erlang Ecosystem CNA team](https://cna.erlef.org/contact) to the
49
+
GitHub vulnerability report as collaborators.
50
+
- [`IngelaAndin`](https://github.com/IngelaAndin) – OTP Core Contributor
51
+
- [`maennchen`](https://github.com/maennchen) – CISO, EEF
52
+
- [`voltone`](https://github.com/voltone) – Bram Verburg – Security WG Chair
53
+
3. Test the vulnerability and have any discussion about the details in the report comments.
54
+
4. Prepare a fix in a **private** branch.
55
+
5. The EEF team fills in the details of the report.
56
+
6. Resolve the vulnerability by doing these steps concurrently:
57
+
1. Merge fix.
58
+
2. Publish CVE on GitHub.
59
+
3. Release fixed version.