Report a vulnerability privately through GitHub. Do not open a public issue, pull request or discussion for it.
- Open the affected repository in the DevelopmentFinanceObservatory organisation.
- Select the Security tab, then "Report a vulnerability".
- Describe the problem and submit the report.
If you cannot tell which repository is affected, report it on website.
- The repository, and the commit, release or URL where you found the problem.
- What the vulnerability is and what an attacker could do with it.
- Steps to reproduce it, with a proof of concept if you have one.
- Any logs, requests or screenshots that help, with secrets and personal data removed.
The policy covers the code in the repositories of this organisation and the site at developmentfinance.org. Vulnerabilities in third-party software, such as Google Data Commons or our dependencies, belong with their maintainers, though we want to hear if a DFO deployment exposes one.
There is no bug bounty. Please give the maintainers time to fix a problem before you disclose it publicly.