To your customers, you are. The maintainer wrote the code, but you chose it, packaged it, and control when a fix reaches the customer. Legally, who is liable depends on contracts, licenses, and regulation, so ask counsel. Operationally, plan to own the response.
Two different questions
People mix up responsibility for the flaw and responsibility for the response.
- The flaw. The upstream project wrote the vulnerable code. Open source licenses commonly disclaim warranties, so the maintainer is usually not on the hook to you. Read the license text of each component.
- The response. You decide which version ships, whether to upgrade, and how to tell customers. A customer cannot patch a library they did not know was inside your product.
What regulation points toward
The EU Cyber Resilience Act is one example. The European Commission's overview says it requires manufacturers to handle vulnerabilities during the lifecycle of their products and that obligations apply at every stage of the value chain. Recital 34 of the regulation says a manufacturer that finds a vulnerability in a component should inform whoever makes or maintains it, and address and remediate the vulnerability. The direction is clear: the manufacturer of the final product is expected to act.
CISA's Secure by Design material says technology providers should take ownership of their products' security at the executive level. Neither source is a substitute for legal advice about your situation.
A working split of duties
| Task | Owner |
|---|---|
| Choose components with care | Your product and engineering team |
| Know what is in each release | Your team, via an inventory or SBOM |
| Monitor for new advisories | Your team |
| Tell the maintainer what you found | Your team, using the project's security contact |
| Fix upstream | The maintainer, or you through a contribution |
| Deliver the fix to customers | Your team |
| Apply the update | Customer, or you if hosted |
Steps when a vulnerability is found
- Confirm whether your build includes the vulnerable component and code path.
- Check whether upstream has a fix, and apply it or a mitigation.
- Report new findings to the maintainer using their documented process.
- Tell customers with a clear statement: affected or not, fixed version, action required.
- Record the timeline.
Reduce the surprise
Keep an inventory per release, choose well maintained components, and have a named owner for upstream contact. These three habits turn a scramble into a routine.
Quick check
Can we blame the maintainer to a customer?
It does not help. Customers expect you to explain impact and give them a fix.
Do open source licenses make maintainers liable?
Licenses commonly disclaim warranties. Read each one and ask counsel about your specific case.
Safeguard's SBOM and dependency scanning and autonomous remediation with fix PRs (off by default, with every category on Manual) can help you find and fix shipped components, and the free scan is at gold.safeguard.sh/scan.
Sources
- European Commission, Cyber Resilience Act
- Regulation (EU) 2024/2847 on EUR-Lex
- CISA Secure by Design
Last reviewed: 19 October 2026.
