# Email Draft — CWE-407 Pre-Disclosure Outreach

**To:** [maintainer security contact — see README.md for sequencing]
**From:** security@undefect.com
**Subject:** Pre-disclosure: CWE-407 in [TOOL] — coordinated disclosure request
**Attachment:** [tool].pdf  (also in outreach.tar.gz · MD5: see MD5SUMS)

---

Hello [maintainer name],

We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in
**[TOOL]**. We have a patch, a complexity proof, and a benchmark. We are requesting a
**90-day coordinated disclosure window** before any public release.

**The short version:**

A list is used where a set belongs, inside a [graph traversal / query planning / dependency
resolution] loop. Membership is tested by linear scan. The result is O(n²) behavior in
code that should run in O(n). The fix is a one-line data structure substitution with no
behavioral change.

The attached brief covers:

- The exact file and line
- Before/after code
- Complexity proof (O-notation)
- Benchmark numbers
- The patch

**What we ask:**

1. Confirm receipt within 5 business days.
2. Validate the patch against your CI / regression suite.
3. Coordinate a release date within the 90-day window.
4. Credit optional — the goal is the fix, not the credit.

We are disclosing to all affected maintainers on a sequenced schedule. Your disclosure
window starts from the date of this email.

Reply to this address or open a security advisory at your discretion.

— undefect.
  security@undefect.com
  https://undefect.com

---

**Attachment integrity:**

```
[PASTE MD5 FROM outreach/MD5SUMS for the specific PDF]
```

Verify with: `md5sum [tool].pdf`
