# Cold Outreach Contacts — CWE-407 Discovery

**2026-03-27 · Ground truth from full-paper.md**

Two types of contacts:
1. **Maintainer contacts** — pre-disclosure, one per tool, confidential 90-day window
2. **Cold outreach** — post-disclosure, press/researchers/community, after first wave clears

---

## Part 1 — Maintainer Pre-Disclosure Contacts

### Compilers and Language Runtimes

| Tool | Security Contact | Method |
|------|-----------------|--------|
| OpenJDK / javac | security@openjdk.org | Email |
| TypeScript | github.com/microsoft/TypeScript/security/advisories/new | GitHub Advisory |
| GHC | security@haskell.org | Email |
| Scala 3 | security@scala-lang.org | Email |
| rustc / Rust | security@rust-lang.org | Email |
| Kotlin | security@jetbrains.com | Email |
| GCC | security@gcc.gnu.org | Email |
| LLVM / Clang | security@llvm.org | Email |
| V8 / Chrome | https://g.co/vulnz (Google VRP) | Google VRP |
| SpiderMonkey / Firefox | security@mozilla.org | Email |

### Build Tools and Package Managers

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Maven | security@apache.org [MAVEN] | Email |
| CMake | cmake-security@kitware.com | Email |
| npm arborist | hackerone.com/nodejs-ecosystem | HackerOne |
| pip / distlib | security@python.org | Email |
| Composer / PHP | github.com/composer/composer/security/advisories/new | GitHub Advisory |
| Bazel | security@bazel.build | Email |
| Jenkins | jenkinsci-advisories@googlegroups.com | Email |
| BuildKit / Docker | security@docker.com | Email |
| Luigi / Spotify | github.com/spotify/luigi/security/advisories/new | GitHub Advisory |

### Language Runtimes

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Erlang OTP | erlang-security@erlang.org | Email |
| SWI-Prolog | bugs.swi-prolog.org (security tag) | Bug tracker |

### Web Frameworks

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Django | security@djangoproject.com | Email |
| Rails | security@rubyonrails.org | Email |
| Pyramid / Pylons | github.com/Pylons/pyramid/security/advisories/new | GitHub Advisory |
| Bottle | github.com/bottlepy/bottle/security/advisories/new | GitHub Advisory |

### ORM / Database Frameworks

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Hibernate | github.com/hibernate/hibernate-orm/security/advisories/new | GitHub Advisory |
| MyBatis | security@apache.org [MYBATIS] | Email |
| EF Core / .NET | msrc.microsoft.com/create-report | MSRC |
| SQLAlchemy | github.com/sqlalchemy/sqlalchemy/security/advisories/new | GitHub Advisory |
| Peewee | github.com/coleifer/peewee/security/advisories/new | GitHub Advisory |
| Sequelize | github.com/sequelize/sequelize/security/advisories/new | GitHub Advisory |
| TypeORM | github.com/typeorm/typeorm/security/advisories/new | GitHub Advisory |
| Doctrine | github.com/doctrine/orm/security/advisories/new | GitHub Advisory |
| SeaORM | github.com/SeaQL/sea-orm/security/advisories/new | GitHub Advisory |
| Diesel | github.com/diesel-rs/diesel/security/advisories/new | GitHub Advisory |
| GORM | github.com/go-gorm/gorm/security/advisories/new | GitHub Advisory |
| Exposed | github.com/JetBrains/Exposed/security/advisories/new | GitHub Advisory |

### Databases

| Tool | Security Contact | Method |
|------|-----------------|--------|
| PostgreSQL | security@postgresql.org | Email |
| MongoDB | security@mongodb.com | Email |

### Game Engines and Graphics

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Godot Engine | security@godotengine.org | Email |
| pygame | github.com/pygame/pygame/security/advisories/new | GitHub Advisory |
| SFML | github.com/SFML/SFML/security/advisories/new | GitHub Advisory |
| Three.js | github.com/mrdoob/three.js/security/advisories/new | GitHub Advisory |
| AngelScript | bugs.angelcode.com (Performance category) | Bug tracker |
| Dry (Urho3D fork) | github.com/urho3d/Urho3D/security/advisories/new | GitHub Advisory |
| Apache TinkerPop | security@apache.org [TINKERPOP] | Email |

### Blockchain

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Solidity / Ethereum | github.com/ethereum/solidity/security/advisories/new | GitHub Advisory |

### Network / Routing / SDN

| Tool | Security Contact | Method |
|------|-----------------|--------|
| FRRouting | security@frrouting.org | Email |
| BIRD | security@nic.cz | Email |
| ONOS | github.com/opennetworkinglab/onos/security/advisories/new | GitHub Advisory |
| Apache httpd | security@apache.org [HTTPD] | Email |

### Infrastructure / DevOps

| Tool | Security Contact | Method |
|------|-----------------|--------|
| Terraform / HashiCorp | security@hashicorp.com | Email |
| Ansible / Red Hat | ansible-security@redhat.com | Email |
| SaltStack / VMware | salt-security@vmware.com | Email |
| CFEngine / Northern.tech | security@northern.tech | Email |
| Puppet / Perforce | security@puppet.com | Email |

### Code Quality / LSP

| Tool | Security Contact | Method |
|------|-----------------|--------|
| RuboCop | github.com/rubocop/rubocop/security/advisories/new | GitHub Advisory |
| Solargraph | github.com/castwide/solargraph/security/advisories/new | GitHub Advisory |

### Graph / Scientific

| Tool | Security Contact | Method |
|------|-----------------|--------|
| NetworkX | github.com/networkx/networkx/security/advisories/new | GitHub Advisory |

### Messaging / EDA / Other

| Tool | Security Contact | Method |
|------|-----------------|--------|
| RabbitMQ / VMware | security@rabbitmq.com | Email |
| KiCad | security@kicad.org | Email |
| GNU Octave | bug-octave@gnu.org (Performance tag) | Email |
| Tor Project | security@torproject.org | Email |
| Minecraft / Mojang | bugs.mojang.com (Performance category) | Bug tracker |

---

## Part 2 — Cold Outreach (Post-Disclosure)

Send after at least Wave 1 maintainers have confirmed receipt. Full blast after public release.

### CVE Coordination

| Contact | Address | Notes |
|---------|---------|-------|
| MITRE CVE Program | cve@mitre.org | Request CVEs for unpatched/critical sites |
| NIST NVD | nvd@nist.gov | Post-disclosure NVD enrichment |
| CERT/CC | cert@cert.org | Cross-project coordinated disclosure support |
| OpenSSF | security@openssf.org | Cross-ecosystem CWE-407 pattern — supply chain mandate |
| GitHub Security Lab | securitylab@github.com | Research partnership |

### Security Press

| Contact | Outlet | Address / URL |
|---------|--------|---------------|
| Dan Goodin | Ars Technica | dan.goodin@arstechnica.com |
| The Register | The Register | security@theregister.com |
| SecurityWeek | SecurityWeek | editors@securityweek.com |
| Bleeping Computer | Bleeping Computer | https://www.bleepingcomputer.com/submit-news/ |

### Security Newsletters / Podcasters

| Contact | Channel | URL |
|---------|---------|-----|
| Clint Gibler | tl;dr sec | https://tldrsec.com/contact |
| Patrick Gray | Risky Business | https://risky.biz/contact |
| Bruce Schneier | Schneier on Security | https://www.schneier.com/contact/ |
| Trail of Bits | Trail of Bits Blog | contact@trailofbits.com |

### Academic / Research Venues

| Venue | Submission URL | Notes |
|-------|---------------|-------|
| USENIX Security | usenix.org/conference/usenixsecurity | Full paper track |
| USENIX WOOT | co-located with USENIX Security | Workshop, faster review |
| IEEE S&P (Oakland) | ieee-security.org/TC/SP2026/ | High prestige |
| ACM CCS | sigsac.org/ccs/ | Strong systems security |
| NDSS | ndss-symposium.org | Network security angle (FRR, BIRD) |
| PLDI / OOPSLA | pldi.sigplan.org / splashcon.org | Compiler track (javac/tsc/ghc/scala3) |

### Developer Community

| Platform | Handle / URL | Notes |
|----------|-------------|-------|
| Hacker News | news.ycombinator.com/submit | "Show HN: CWE-407 in 66 open source projects" |
| lobste.rs | lobste.rs | Tags: security, compilers, performance |
| r/netsec | reddit.com/r/netsec | 500k+ subscribers |
| NANOG mailing list | nanog@nanog.org | For FRRouting / BIRD / ISP operators |

### Corporate Security Teams (User Impact)

| Org | Affected Tools | Contact |
|-----|---------------|---------|
| Meta | Presto, Kafka, React (webpack) | security@meta.com |
| Netflix | Presto, Spark, Kafka | security@netflix.com |
| Airbnb | Presto, Kafka, Spark | security@airbnb.com |
| Uber | Presto, Kafka | security@uber.com |
| Google | V8, Bazel, Chromium (LLVM) | https://g.co/vulnz |
| Microsoft | TypeScript, EF Core | msrc.microsoft.com |

---

## Cold Outreach Draft (post-disclosure)

**Subject:** CWE-407 across 66 open source tools — public whitepaper

```
Hello,

We recently completed coordinated disclosure of CWE-407 (Inefficient Algorithmic
Complexity) across 66 open source projects — compilers, ORMs, web frameworks, game
engines, routing daemons, and infrastructure tools.

157 sites patched. The root cause is the same in every case: a list where a set belongs,
inside a graph traversal loop. One patch type, 52 ecosystems, speedups from 15x to 300x.
One site (Minecraft DependencySorter) is exponential — StackOverflow at depth 16.

Full whitepaper and per-project briefs: https://undefect.com

— undefect.
  security@undefect.com
```

---

## Send Status

| # | Contact | Sent | Response |
|---|---------|------|----------|
| — | — | — | — |
