Request for acknowledgment on responsibly disclosed security reports

[hits313]

Earlier last month end I responsibly disclosed a couple of security issues to security@sim.ai, which appear to have since been addressed and referenced in a published patches silently

@waleedlatif1 Your security advsiory policy mentions recognition. Despite several follow-up emails I haven't received any acknowledgment, credit, or response. Could a maintainer please confirm receipt and advise the right channel to coordinate? Happy to share the original report privately.

[hits313]

hey team any update ?

[hits313]

Bumping this thread. To summarize the timeline:

• Initial responsible disclosure to security@sim.ai: 30+ days ago
• Multiple follow-up emails: unanswered
• Issues silently patched and referenced in public commits: confirmed
• GitHub issue Request for acknowledgment on responsibly disclosed security reports #4795 opened 5 days ago: no maintainer response
• Follow-up comment 3 days ago: no maintainer response

Your SECURITY.md commits to acknowledging reporters. That has not happened.

I am giving a final 14-day window for a maintainer to respond on this issue with (1) confirmation of receipt, (2) CVE coordination plan, and (3) reporter credit in the relevant advisories. After that window, I will publish the full technical writeups publicly as the disclosure is effectively already complete on your end.

Happy to keep this private and collaborative if someone engages. /cc @waleedlatif1

[hits313]

Disclosure report filled up for medium and open vdp-bugbounty thanks