Vulnerability Disclosure Policy

Last updated: 29 October 2026

If you find a security vulnerability in Waterfox, email security@browser.works privately. You can also report vulnerabilities in Waterfox websites and services operated by BrowserWorks Ltd.

How to report a vulnerability

Email security@browser.works with a short description of the issue in the subject line. Please write your report in English where possible.

Please give us time to investigate before posting exploit details in a public issue tracker, on a forum or on social media. For ordinary bugs or help using Waterfox, use the help centre.

If you need to share sensitive information, send a brief summary first so we can agree on how to share the details. Leave passwords, access tokens and other people’s personal data out of your report.

What to include

Please include as much of the following as you can:

• The affected product, website or service. For browser issues, include your Waterfox and operating system versions, along with any relevant extensions or settings changes.
• What the vulnerability could allow someone to do and what they would need to exploit it.
• Steps to reproduce the issue. A minimal proof of concept or test case helps, if you have one.
• Relevant URLs, screenshots, logs or crash details. Remove secrets and personal data before sending them.
• Whether you have seen anyone exploiting the issue or reported it elsewhere. Include any existing advisory or CVE reference.
• Contact details so we can ask follow-up questions.

Send what you have, even if some details are missing. Tell us which findings you have verified and which you still suspect.

When to expect a response

We aim to acknowledge your report within 7 calendar days of receiving it.

After that, we aim to update you at least every 30 calendar days until we close the report, including while we are still investigating. We will tell you where the investigation stands and ask for any information we need. Where we know the next steps, we will share them. If we expect an update to be late, we will explain why and give you a new date.

These targets cover our replies. We cannot guarantee how long it will take to resolve an issue. That depends on how serious and complex it is, and whether we need to work with an upstream project or service provider. When we close the report, we will tell you the outcome.

If you have not received an acknowledgement after 7 calendar days, please follow up at the same address and include the date of your original report.

Testing and coordinated disclosure

Use your own accounts and test data. Avoid disrupting services or accessing, changing or deleting other people’s data. If you come across someone else’s data, stop testing. Report what happened without copying or sharing their data.

This policy does not give you permission to test systems belonging to BrowserWorks or third parties. Contact us first if you are unsure whether a test is appropriate.

Please work with us to agree on a disclosure date that gives users time to receive a fix or mitigation. If the issue involves an upstream project or a third-party service, we may need to coordinate with its maintainers. Let us know about any disclosure deadline you are working towards.

Machine-readable contact information

Our security contact and a link to this policy are also available in security.txt.