Skip to content
HavenHaven docs

Coordinated disclosure

Haven runs a coordinated vulnerability disclosure (CVD) channel. If you found a security problem in a crate hosted or mirrored on this instance, or a crate you believe is malicious, this is the way in. You do not need an account.

How to report

Section titled “How to report”

File the report at haven.rs/cvd. The form asks for:

  • Crate: the affected crate’s name, for example some-crate. The crate does not have to exist on this instance; reports about an unpatched upstream are welcome.
  • Version: the affected version, or the earliest one you know of.
  • Registry (optional): which registry on this instance hosts the crate, if you know it. Companies reporting against their own private or public registry should fill this in; it rides into the compliance artifacts. Leave it empty for upstream crates.
  • Description: what you found, how to reproduce it, and what the impact is. Malicious-crate reports go through this same field: say what the crate does and why you believe it is hostile.
  • Contact: an email address we can reach you at for coordination.

Prefer email? Write to security@vleue.com. The machine-readable pointer lives at haven.rs/.well-known/security.txt (RFC 9116).

Anonymous reports are rate limited per address; if the form refuses you, wait a little or use the email route.

What happens next

Section titled “What happens next”
  • Filing returns a report id like CVD-00001. It is shown once, in the response: keep a copy if you want to reference the report later.
  • The report is timestamped and lands in the instance’s tamper-evident audit log the moment it is filed.
  • The operators review every report. If it is valid, the report drives the CRA incident cadence: an early warning within 24 hours, a vulnerability notification within 72 hours, and a final report within 14 days, each generated from the timestamped record.
  • We use your contact address to coordinate: to ask questions, to agree on a disclosure timeline, and to credit you if you want credit.

What we ask of reporters

Section titled “What we ask of reporters”

Give us a reasonable window to investigate and remediate before public disclosure. Do not access data that is not yours, and do not degrade the service while demonstrating an issue. We will not take legal action against good-faith security research within those bounds.