Reporting a vulnerability in EventLake
Report a vulnerability in EventLake.
If you have found a flaw in this platform, this is the door. The programme below is published by the running deployment, not written on this page — what you read here is what the software will actually hold itself to.
Or write to vuln@eventlakes.com — the address is read whether or not a programme is published below.
The disclosure programme
Read from this deployment, not written on this page.
GET /v1/trust/vdp
Reading the published programme…
Report a vulnerability
No account, no name required.
Anonymous reports are accepted. If you leave no address we cannot acknowledge or credit you, and the disclosure clock still runs.
POST /v1/trust/report
If anything goes wrong on the way, this page says the report did not reach us — never "thank you". A confirmation here means the report is recorded, not that a server answered.
Published advisories
A severity is computed from the published vector rather than asserted, so the two cannot disagree. An affected range is stated exactly or omitted; nothing guesses at which versions were vulnerable to make a list look complete.
GET /v1/trust/advisories
Reading published advisories…
Machine-readable
Automated tooling should read /.well-known/security.txt (RFC 9116), which is generated from the live programme on every request — so its expiry is always current and it can never advertise contacts the programme has stopped honouring. It returns 404 for the same reason this page shows no form when nothing is declared.
How we think about this
The trust & assurance brief (4 pp) is the review team's document: how the platform is built, tested and operated, what you can verify without taking our word, and what is still outstanding. Three of the Notes on Active Defense bear on this page directly — the vendor is part of your attack surface, what we do not detect, and compiling what you learn.
Scope & Honest Limits Honest limits of this programme Expand · Full ledger →
We are not a CVE numbering authority
Our advisory identifiers are ours. An advisory names a CVE only once one has been assigned, which means the CVE can lag the advisory.
No bounty
There is no payment for reports. An advisory can credit you if you want it. Whether safe harbour applies is what the published programme declares — this page renders that answer rather than promising one.
We hold no security certifications
A control mapping is published, and a mapping is not an audit. We will not list a standard here until somebody independent has signed against it.
On-premise means you patch
On an on-premise deployment an advisory tells you what to upgrade, and the upgrade is yours to schedule. As SaaS, how upgrades are applied is described in your customer agreement, not assumed from this page.
Everything above is generated from the programme itself
The contacts, the windows, the safe-harbour answer, the scope and the advisory list are read from the declared programme rather than typed into this page; the one typed line is the address at the top, which says where to write and nothing about what happens next. That is why the page can honestly say nothing is published when nothing is — the alternative is a static page that keeps promising a window after the promise has lapsed.
Next step
Inspect measured detection coverage or verify release provenance.