How to report Security Vulnerability?

[rAcKShen]

Found two security issues. Not critical software bugs. But one scores high. Did not calculate the other. And they are not in the building blocks used by Keenetic but in the configuration. So, for me, nothing to report upstream to any open-source project. I have report to Keenetic directly. Fixing them, I do not think they are very complex, should be not more than one line of code. So, worth to be reported.

Many companies go for FIRST and make it easy for security researchers by providing a secure communication channel/contact/E-mail (via the provided public OpenPGP key). Does anyone know how Keenetic likes it? OpenPGP or S/MIME? Do I go for my local country support? Or a global E-mail address (tried security@ and psirt@ but failed)? Or do we go for private messages via this board (would be OK for me)? Or do we go via GitHub (no policy posted)?

[KYTECHNGAMING]

15 minutes ago, rAcKShen said:

Found two security issues. Not critical software bugs. But one scores high. Did not calculate the other. And they are not in the building blocks used by Keenetic but in the configuration. So, for me, nothing to report upstream to any open-source project. I have report to Keenetic directly. Fixing them, I do not think they are very complex, should be not more than one line of code. So, worth to be reported.

Many companies go for FIRST and make it easy for security researchers by providing a secure communication channel/contact/E-mail (via the provided public OpenPGP key). Does anyone know how Keenetic likes it? OpenPGP or S/MIME? Do I go for my local country support? Or a global E-mail address (tried security@ and psirt@ but failed)? Or do we go for private messages via this board (would be OK for me)? Or do we go via GitHub (no policy posted)?

Go to your https://keenetic.cloud/

and click Support link. 

or it is shortcut for you. https://help.keenetic.com/hc/en-us/requests/new

[admin]

2 hours ago, rAcKShen said:

Do I go for my local country support? Or a global E-mail address

Please, drop a message to support@keenetic.de. It makes no sense to open this kind of discussion here.

[rAcKShen]

I tried that first: #10407. However, they did not know about the procedure at all. Therefore, I tried several possible E-mail addresses. And then tried here. Not sure how to proceed.

[admin]

19 hours ago, rAcKShen said:

Therefore, I tried several possible E-mail addresses. And then tried here. Not sure how to proceed.

Please continue with support@keenetic.de, that's the proper contact window for you. They will have to work out the procedure, even if it doesn't exist now.

[rAcKShen]

OK. Works now. Submitted. 😀