Puppet Labs

Puppet Labs supports coordinated disclosure of security vulnerabilities.

Please note that we have separate processes for reporting security issues with our product line, and for reporting security issues with our infrastructure.

Note that we do not consider the following class of issues to be report-worthy when they relate to our infrastructure:

• Software version/Banner disclosure
• Directory traversal on yum/apt/downloads.puppetlabs.com where traversal is explicitly desired
• Self-XSS/CSRF on unauthenticated web forms (including logout CSRF)
• Disclosure/Discovery of known public files or directories(e.g., robots.txt, simple DNS enumeration)
• Brute Force attempts (e.g., Login Page/Forgot Password without lockouts)
• Account enumeration (e.g., enumerating Login/Reset fields for valid accounts without lockouts)

To contact the Puppet Labs Infrastructure team, please use the email address: [email protected]