Node.js says a report is normally acknowledged within five days, with a more detailed response within ten. Once a fix is confirmed, the embargo date is typically 72 hours after the CVE is issued, and a copy of the advisory goes on the Node.js blog within six hours of the security mailing list being notified.
Reporting and response times
The Node.js security policy tells reporters to use the project's report form on HackerOne. It adds that timelines can stretch when triage volunteers are away, especially at year end. If there is no acknowledgement within six business days, or you cannot find a private contact for a project, the policy allows escalation to the OpenJS Foundation CNA. If a report is acknowledged but nothing further happens within 14 days, escalation is also appropriate.
The policy says Node.js no longer has a bug bounty program, and that security bugs in third party modules go to their own maintainers.
The disclosure steps
| Step | What happens |
|---|---|
| Receive | A primary handler is assigned, who coordinates the fix and release |
| Validate | The issue is checked against all supported versions and a list of affected versions is made |
| Audit | Code is checked for similar problems |
| Prepare | Fixes are prepared for all supported releases and held locally, not in the public repository |
| Schedule | An embargo date is suggested and a CVE is requested |
| Release | On the embargo date the announcement goes to the security mailing list, changes are pushed, builds deployed |
| Publish | The advisory appears on the project blog within six hours of the list being notified |
Typically the embargo is set 72 hours from when the CVE is issued, but it may vary with severity or the difficulty of applying a fix.
What to learn from it
The policy has concrete numbers a reporter can hold the project to, and it explains what happens when the numbers slip. Compare with the Go policy, which acknowledges within seven days, and the OpenSSF badge criteria, which ask for an initial response within 14 days for reports received in the last six months. Nothing about a project's response time is a guarantee of quality, but written targets make accountability possible.
Steps for a project writing its own policy
- State where reports go and who sees them.
- Give an acknowledgement target and a detailed response target.
- Say what happens if you miss a target, and where reporters can escalate.
- Describe each stage in the order it happens.
- Name your usual embargo length and say it can vary.
- Explain how and where you publish advisories, and how quickly.
- State plainly what you do not offer, such as a bounty.
For dependents
Read the policy of every project you depend on for security-sensitive work. If it names a mailing list, subscribe. If it names an embargo pattern, plan for the release date.
Try it yourself
Click through it at your own pace, or open it full screen. See how a gate stops a risky change, and think about how an announced release date could feed a rule that holds a build until you have updated.
Quick check
Who do I report a bug in a third party Node.js module to?
The policy says to report it to that module's maintainers.
What if I hear nothing after six business days?
The policy says you may escalate to the OpenJS Foundation CNA.
Is there a bounty?
The policy says the project no longer has a bug bounty program.
How Safeguard helps
Safeguard's SBOM and dependency scanning show which upstream versions you depend on, and reachability analysis helps you decide which advisories matter for your code. Compliance and evidence automation can record how you handled each one. Autonomous remediation can open fix pull requests; it is off by default and every category starts on Manual. You can run the free scan on a manifest to see where you stand.
Sources
- Node.js, SECURITY.md: reporting, escalation and disclosure policy. Fetched 19 October 2026.
- The Go Project, Go Security Policy: acknowledgement timeline. Fetched 19 October 2026.
- OpenSSF, Badge criteria, passing level: vulnerability report response criterion. Fetched 19 October 2026.
Last reviewed: 19 October 2026.
