Skip to content
SGITF
AboutApplySessionsNewsDisclosureContactMembers area

Resources

Coordinated vulnerability disclosure

Found a vulnerability affecting a Singapore organisation and can't reach them? We can help connect you.

How to report

  1. Try the organisation's own security.txt or published disclosure channel first.
  2. If that fails, email disclosure@sgitf.org with a description, the affected systems and how to reproduce.
  3. We'll use our member network to reach the right person, and keep you updated.

Please don't access more data than needed to demonstrate the issue, and give the organisation reasonable time to fix it before publishing.

Serious incidents can also be reported to SingCERT.

Traffic Light Protocol

SGITF uses FIRST TLP 2.0. On the members platform the label isn't a suggestion — the database only returns an item to the people its label allows.

  • TLP:CLEARPublic — visible to anyone
  • TLP:GREENAll vetted SGITF members
  • TLP:AMBERYour organisation and the owning group
  • TLP:AMBER+STRICTYour organisation only
  • TLP:REDOnly named recipients