{"id":99935,"date":"2025-01-13T11:00:06","date_gmt":"2025-01-13T09:00:06","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?page_id=99935"},"modified":"2026-03-20T15:54:55","modified_gmt":"2026-03-20T13:54:55","slug":"disclosure-policy","status":"publish","type":"page","link":"https:\/\/checkmarx.com\/zero\/disclosure-policy\/","title":{"rendered":"Disclosure Policy"},"content":{"rendered":"

This disclosure policy sets forth the standards and procedures for submission, review and publication of vulnerabilities identified by members of our security community to enable the open sharing of verified information in a responsible way to protect our community and their users. Reports submitted to oss-report@checkmarx.com<\/a> will be reviewed and handled in accordance with this policy.<\/p>\n\n\n\n

1. Prerequisites<\/strong>\n<\/h2>\n\n\n\n

We will review vulnerabilities identified in libraries that meet the following prerequisites:<\/p>\n\n\n\n

1.1. The Code was released as an Open-Source Code and it is not proprietary code or a commercial license requiring payment.<\/p>\n\n\n\n

1.2. The Open-Source Code was developed by individuals and not by a commercial entity and is not related to any project or side-project of any commercial entity.<\/p>\n\n\n\n

1.3.The Open-Source Code is accompanied by, or obtained under, a license that details the terms and conditions governing the use of such Open-Source Code.<\/p>\n\n\n\n

1.4. The Open-Source Code license type does not require any modifications of the Open-Source Code to be distributed using the same license or a “compatible” license (known approved licenses include MIT, ISC and BSD). The OSS license terms and conditions can usually be found in a LICENSE.txt file.<\/p>\n\n\n\n

Note: Files within the Open-Source Code repository may have different licenses, therefore to make sure the repository meets these prerequisites, please run additional search for some common license-related terms such as, licen, redist, copyright, public or any common license fragments such as, MIT, GPL, BSD and Apache, for any Open-Source Code User intends to check.<\/p>\n\n\n\n

1.5. For more information regarding open source license types, User can visit https:\/\/opensource.org\/licenses<\/a>.<\/p>\n\n\n\n

2. Disclosure<\/strong>\n<\/h2>\n\n\n\n

Vulnerabilities identified by community members that meet the prerequisites above can be disclosed to oss-report@checkmarx.com.<\/a> A submitted vulnerability disclosure should contain the following required details:<\/p>\n\n\n\n