Reporting security vulnerabilities

[anomaly0617]

Hypothetically, let's say we find a security vulnerability in OPNSense that we want to (privately!) bring to the attention of developers to get it resolved quickly and quietly. Who should we send this data to, and how should we send it?

Thanks!
-Anomaly0617

[franco]

Hi there,

Drop us a line at security@opnsense.org -- a PGP key is available if required.


Cheers,
Franco

[anomaly0617]

Hi Franco,

A PGP key would be appreciated. Thanks!

[anomaly0617]

Found the GPG key, encrypted it and sent it to you for review.

Thanks, Franco!