Vítor Fonte

Security researcher, University of Minho (writing in an independent capacity)

I look for security vulnerabilities in open-source software and report them to the maintainers through their official channels, so that they can be fixed before the details are made public.

Contact

security@vfonte.net. Encrypted email is preferred, especially for anything that concerns an unfixed vulnerability.

PGP key

Fingerprint: 8279 A498 745A 7BED 6828 61A2 9367 71A1 D42F 94F0

• Download the public key
• keys.openpgp.org
• Published via WKD, so WKD-aware clients can discover it from the address.

Disclosure policy

• I report through the channel each project designates (security policy, advisory form or security contact). The details stay private until the publication date set out below.
• The deadline is 90 days from my first report to the maintainers, and I state it in that report. If the vulnerability is already being actively exploited, the deadline is 7 days instead, with no extension.
• A fix means a release, or an official patch the maintainers publish for users to apply; a commit alone does not count. If a fix is released within the 90-day (or 7-day) deadline, I publish an advisory 30 days after the fix is released, or earlier by agreement, even if an extension had been granted. If there is no fix by the deadline and no extension has been agreed, I publish when the deadline expires.
• If the maintainers expect a fix within 14 days after the 90-day deadline, I will extend the deadline by up to 14 days, on request before it expires. If the fix is released during the extension, I publish on day 120 after my first report, or earlier by agreement. If it is not, I publish when the extension ends.
• If the details become public before my publication date, I may publish then.
• Advisories describe the issue and, where available, the fix or mitigations. I do not produce or publish weaponised exploits.
• If I receive no response, I follow up and may then ask a coordinator, such as CERT/CC or the relevant national CSIRT, to help reach the maintainers. The deadline still applies.
• I test only against instances I own and control, never against third-party production systems.
• I ask to be credited as Vítor Fonte in the advisory and the CVE record.

Elsewhere

• GitHub: vfonte-security
• security.txt