engineering/java-topology

Fork 0

russell@unturf.com 16cc7ecf1d wave8 complete + outreach: 452/202, 40 outreach briefs, buck2/ant CLEAN

2026-03-27 16:45:01 -04:00

9.2 KiB

Raw Blame History

Cold Outreach Contacts — CWE-407 Discovery

2026-03-27 · Ground truth from full-paper.md

Two types of contacts:

Maintainer contacts — pre-disclosure, one per tool, confidential 90-day window
Cold outreach — post-disclosure, press/researchers/community, after first wave clears

Part 1 — Maintainer Pre-Disclosure Contacts

Compilers and Language Runtimes

Tool	Security Contact	Method
OpenJDK / javac	security@openjdk.org	Email
TypeScript	github.com/microsoft/TypeScript/security/advisories/new	GitHub Advisory
GHC	security@haskell.org	Email
Scala 3	security@scala-lang.org	Email
rustc / Rust	security@rust-lang.org	Email
Kotlin	security@jetbrains.com	Email
GCC	security@gcc.gnu.org	Email
LLVM / Clang	security@llvm.org	Email
V8 / Chrome	https://g.co/vulnz (Google VRP)	Google VRP
SpiderMonkey / Firefox	security@mozilla.org	Email

Build Tools and Package Managers

Tool	Security Contact	Method
Maven	security@apache.org [MAVEN]	Email
CMake	cmake-security@kitware.com	Email
npm arborist	hackerone.com/nodejs-ecosystem	HackerOne
pip / distlib	security@python.org	Email
Composer / PHP	github.com/composer/composer/security/advisories/new	GitHub Advisory
Bazel	security@bazel.build	Email
Jenkins	jenkinsci-advisories@googlegroups.com	Email
BuildKit / Docker	security@docker.com	Email
Luigi / Spotify	github.com/spotify/luigi/security/advisories/new	GitHub Advisory

Language Runtimes

Tool	Security Contact	Method
Erlang OTP	erlang-security@erlang.org	Email
SWI-Prolog	bugs.swi-prolog.org (security tag)	Bug tracker

Web Frameworks

Tool	Security Contact	Method
Django	security@djangoproject.com	Email
Rails	security@rubyonrails.org	Email
Pyramid / Pylons	github.com/Pylons/pyramid/security/advisories/new	GitHub Advisory
Bottle	github.com/bottlepy/bottle/security/advisories/new	GitHub Advisory

ORM / Database Frameworks

Tool	Security Contact	Method
Hibernate	github.com/hibernate/hibernate-orm/security/advisories/new	GitHub Advisory
MyBatis	security@apache.org [MYBATIS]	Email
EF Core / .NET	msrc.microsoft.com/create-report	MSRC
SQLAlchemy	github.com/sqlalchemy/sqlalchemy/security/advisories/new	GitHub Advisory
Peewee	github.com/coleifer/peewee/security/advisories/new	GitHub Advisory
Sequelize	github.com/sequelize/sequelize/security/advisories/new	GitHub Advisory
TypeORM	github.com/typeorm/typeorm/security/advisories/new	GitHub Advisory
Doctrine	github.com/doctrine/orm/security/advisories/new	GitHub Advisory
SeaORM	github.com/SeaQL/sea-orm/security/advisories/new	GitHub Advisory
Diesel	github.com/diesel-rs/diesel/security/advisories/new	GitHub Advisory
GORM	github.com/go-gorm/gorm/security/advisories/new	GitHub Advisory
Exposed	github.com/JetBrains/Exposed/security/advisories/new	GitHub Advisory

Databases

Tool	Security Contact	Method
PostgreSQL	security@postgresql.org	Email
MongoDB	security@mongodb.com	Email

Game Engines and Graphics

Tool	Security Contact	Method
Godot Engine	security@godotengine.org	Email
pygame	github.com/pygame/pygame/security/advisories/new	GitHub Advisory
SFML	github.com/SFML/SFML/security/advisories/new	GitHub Advisory
Three.js	github.com/mrdoob/three.js/security/advisories/new	GitHub Advisory
AngelScript	bugs.angelcode.com (Performance category)	Bug tracker
Dry (Urho3D fork)	github.com/urho3d/Urho3D/security/advisories/new	GitHub Advisory
Apache TinkerPop	security@apache.org [TINKERPOP]	Email

Blockchain

Tool	Security Contact	Method
Solidity / Ethereum	github.com/ethereum/solidity/security/advisories/new	GitHub Advisory

Network / Routing / SDN

Tool	Security Contact	Method
FRRouting	security@frrouting.org	Email
BIRD	security@nic.cz	Email
ONOS	github.com/opennetworkinglab/onos/security/advisories/new	GitHub Advisory
Apache httpd	security@apache.org [HTTPD]	Email

Infrastructure / DevOps

Tool	Security Contact	Method
Terraform / HashiCorp	security@hashicorp.com	Email
Ansible / Red Hat	ansible-security@redhat.com	Email
SaltStack / VMware	salt-security@vmware.com	Email
CFEngine / Northern.tech	security@northern.tech	Email
Puppet / Perforce	security@puppet.com	Email

Code Quality / LSP

Tool	Security Contact	Method
RuboCop	github.com/rubocop/rubocop/security/advisories/new	GitHub Advisory
Solargraph	github.com/castwide/solargraph/security/advisories/new	GitHub Advisory

Graph / Scientific

Tool	Security Contact	Method
NetworkX	github.com/networkx/networkx/security/advisories/new	GitHub Advisory

Messaging / EDA / Other

Tool	Security Contact	Method
RabbitMQ / VMware	security@rabbitmq.com	Email
KiCad	security@kicad.org	Email
GNU Octave	bug-octave@gnu.org (Performance tag)	Email
Tor Project	security@torproject.org	Email
Minecraft / Mojang	bugs.mojang.com (Performance category)	Bug tracker

Part 2 — Cold Outreach (Post-Disclosure)

Send after at least Wave 1 maintainers have confirmed receipt. Full blast after public release.

CVE Coordination

Contact	Address	Notes
MITRE CVE Program	cve@mitre.org	Request CVEs for unpatched/critical sites
NIST NVD	nvd@nist.gov	Post-disclosure NVD enrichment
CERT/CC	cert@cert.org	Cross-project coordinated disclosure support
OpenSSF	security@openssf.org	Cross-ecosystem CWE-407 pattern — supply chain mandate
GitHub Security Lab	securitylab@github.com	Research partnership

Security Press

Contact	Outlet	Address / URL
Dan Goodin	Ars Technica	dan.goodin@arstechnica.com
The Register	The Register	security@theregister.com
SecurityWeek	SecurityWeek	editors@securityweek.com
Bleeping Computer	Bleeping Computer	https://www.bleepingcomputer.com/submit-news/

Security Newsletters / Podcasters

Contact	Channel	URL
Clint Gibler	tl;dr sec	https://tldrsec.com/contact
Patrick Gray	Risky Business	https://risky.biz/contact
Bruce Schneier	Schneier on Security	https://www.schneier.com/contact/
Trail of Bits	Trail of Bits Blog	contact@trailofbits.com

Academic / Research Venues

Venue	Submission URL	Notes
USENIX Security	usenix.org/conference/usenixsecurity	Full paper track
USENIX WOOT	co-located with USENIX Security	Workshop, faster review
IEEE S&P (Oakland)	ieee-security.org/TC/SP2026/	High prestige
ACM CCS	sigsac.org/ccs/	Strong systems security
NDSS	ndss-symposium.org	Network security angle (FRR, BIRD)
PLDI / OOPSLA	pldi.sigplan.org / splashcon.org	Compiler track (javac/tsc/ghc/scala3)

Developer Community

Platform	Handle / URL	Notes
Hacker News	news.ycombinator.com/submit	"Show HN: CWE-407 in 66 open source projects"
lobste.rs	lobste.rs	Tags: security, compilers, performance
r/netsec	reddit.com/r/netsec	500k+ subscribers
NANOG mailing list	nanog@nanog.org	For FRRouting / BIRD / ISP operators

Corporate Security Teams (User Impact)

Org	Affected Tools	Contact
Meta	Presto, Kafka, React (webpack)	security@meta.com
Netflix	Presto, Spark, Kafka	security@netflix.com
Airbnb	Presto, Kafka, Spark	security@airbnb.com
Uber	Presto, Kafka	security@uber.com
Google	V8, Bazel, Chromium (LLVM)	https://g.co/vulnz
Microsoft	TypeScript, EF Core	msrc.microsoft.com

Cold Outreach Draft (post-disclosure)

Subject: CWE-407 across 66 open source tools — public whitepaper

Hello,

We recently completed coordinated disclosure of CWE-407 (Inefficient Algorithmic
Complexity) across 66 open source projects — compilers, ORMs, web frameworks, game
engines, routing daemons, and infrastructure tools.

157 sites patched. The root cause is the same in every case: a list where a set belongs,
inside a graph traversal loop. One patch type, 52 ecosystems, speedups from 15x to 300x.
One site (Minecraft DependencySorter) is exponential — StackOverflow at depth 16.

Full whitepaper and per-project briefs: https://undefect.com

— undefect.
  security@undefect.com

Send Status

#	Contact	Sent	Response
—	—	—	—

9.2 KiB Raw Blame History