Disclosure policy

We look for security flaws in sequencers, lab software and bioinformatics pipelines. When we find one, the vendor or maintainer hears about it privately before anyone else does.

What we report, and to whom

• Open-source tools and workflow engines: to the maintainers through the project's private vulnerability reporting or its published security contact. If a project has neither, we ask a maintainer for a private channel before sending any detail.
• Instruments and vendor software: to the vendor's product security team. For medical and laboratory devices we may also coordinate through CISA, which publishes ICS medical advisories, when the vendor asks or when we can't reach the vendor.
• We send a description, affected versions, a reproduction and our assessment of impact, and we test only on equipment and software we own or are authorised to test.

Timeline

• We publish no details for 90 days after the first report, or until a fix is available, whichever comes first.
• We extend that deadline when a vendor or maintainer is working on a fix and asks. Instruments often need regulatory sign-off before a patch ships, and we take that into account.
• If a flaw is being exploited in the wild, we may shorten the timeline after telling the vendor.

What we publish

• Credit to everyone involved, including the vendor's response and the dates of each step.
• Enough detail for defenders to find and fix affected systems, plus detection guidance where we can write it.
• No working exploit for instrument or clinical systems. No content that would help anyone create or modify harmful biological material.

Research posts that describe how a tool works by design, using its documentation and source, are not disclosures and do not go through this process. We still give maintainers a chance to read them first when a post is about their project.

Reporting a vulnerability to us

Write to the contact in our security.txt with the affected page, service or post. Do not include exploit details in a first message; we will arrange an encrypted channel. We will not take legal action against good-faith research that respects this policy and avoids harm to people and data.

For errors in a post rather than vulnerabilities, see the corrections policy.