Reporting Security Concerns
Codeium takes the security of our products and services seriously. If you believe you have found a security vulnerability in any Codeium-owned services, please report it to us as described below.
Reporting Security Issues
Please do not report security vulnerabilities through public GitHub issues.
Instead, please report them via email to security@codeium.com
Please include the following information in your report including as much technical detail as possible:
- Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
- The location of the affected source code (if applicable)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it
- Any other relevant information
This information will help us triage your report more quickly.
Please compile all information into a single email, encrypted with our public GPG key, include the name of the affected product, and the version of the product affected (if known).
Public GPG Key
Policy
Codeium follows the principle of Coordinated Vulnerability Disclosure.
Safe Harbor
Codeium supports safe harbor for security researchers who:
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services
- Only interact with accounts you own or with explicit permission of the account holder
- Do not exploit a security issue you discover for any reason other than testing
- Report any vulnerability you’ve discovered promptly
- Follow the guidelines outlined in this document
We will not take legal action against you or administrative action against your account if you act according to this policy.
Last updated: December 10, 2024