Support you can plan around
Each product line receives security updates for at least five years, with at least twelve months' notice before end of life.
Trust & compliance
What we commit to, in writing
The parts of a procurement review that usually take three emails: how long each product line is supported, what ships with every release, and how to report a vulnerability.
- Every release
- Bill of materials
- 3 days
- Report acknowledged
- 90 days
- Disclosure window
A bill of materials, every time
A CycloneDX software bill of materials is generated by the build and ships inside the package as well as being published alongside the release.
A disclosure process with dates on it
Reports are acknowledged within three business days and assessed within seven, with a ninety-day default disclosure window and good-faith safe harbour for researchers.