This service is operated by the Erlang Ecosystem Foundation ("EEF", "we"), a 501(c)(3) non-profit organization in Sunnyvale, California, to run the EEF CVE Numbering Authority. Using it means accepting these terms. How we handle personal data is covered separately in the Privacy Policy.
What this service is for
Reporting vulnerabilities in BEAM ecosystem packages, coordinating them with the people who can fix them, and publishing the resulting CVE records.
What is in scope for this CNA, and what makes something a CVE, are set out in Scope and CVE Criteria. Reports outside that scope will be redirected or declined.
Using it responsibly
Report vulnerabilities you have found in good faith. Do not use this service to submit reports you know to be false, to publish someone else's personal data, or to pursue anything unlawful.
Vulnerability coordination depends on discretion. If you are given access to a case, treat what you learn there as confidential until it is published.
Automated access is available through our API at a reasonable volume. Do not scrape, overload, or attempt to reach cases or reports that are not yours.
What you write here
You keep ownership of what you write, and you give the EEF the rights it needs to act as the CNA for it.
By submitting a report, comment or case content, you grant the EEF a perpetual, irrevocable, non-exclusive, worldwide, royalty-free licence, with the right to sublicense, to use, reproduce, adapt, distribute and display what you submit, and to publish it as vulnerability data.
That is what lets us publish advisories under an open licence. Vulnerability data we publish is released under CC-BY 4.0, as the Data Licensing page sets out. Where your contribution goes into one, it is released on those terms as well: anyone may reuse and adapt it, including commercially, as long as they credit the source. Coordinated disclosure only works if the result can be freely redistributed, and this is the grant that makes it possible.
Outside publishing vulnerability data and running this service, we do not sell your content or license it to anyone.
Published records are permanent and public. They go to MITRE, are published as an OSV feed, and are consumed worldwide. Once a record is published it cannot be recalled, and the licence above cannot be withdrawn from what has already been published. Write with that in mind.
You confirm that you have the right to submit what you post and to grant this licence, and that doing so breaks neither these terms nor the law. Do not include other people's personal data without their agreement.
Specifically, do not post content that is unlawful or infringes someone's rights; that is abusive, threatening, harassing, defamatory, or hateful; that is spam, phishing or malware; or that is knowingly false or misleading.
Your account
Sign in with GitHub or hex.pm. You are responsible for what happens under your account and for the security of the provider account behind it. You must be old enough to consent to online services where you live.
You can delete your account at any time from your account settings. What you wrote stays and loses its author, as the Privacy Policy explains.
If you materially break these terms, we will tell you and, where the breach can be put right, give you a chance to do so before suspending your access. We may suspend or remove access immediately where the law is broken, someone's rights are infringed, or a coordination process is put at risk.
Nothing here publishes itself
This is not a social network or a publishing platform. Nothing anyone writes here becomes public on its own. Reports, comments and case content are visible only to the people working the case, and what we publish as an advisory is written and reviewed by the CNA before it goes out.
Case discussion is deliberately append-only, so that the record of a coordination stays intact for everyone working it. That means we do not edit or withdraw what people wrote. If something written here breaks these terms or the law we will remove it, and where it warrants it remove the account that posted it, but this is an operator intervention rather than a routine feature.
If you think something here should not be here, or you disagree with a decision we have taken about your content or your account, tell us and a person will look at it.
Our software
The software running this service is open source under the Apache 2.0 licence, and you are free to use it under those terms: github.com/erlef-cna/varsel.
The EEF's name, logo and branding are not covered by that licence, and these terms grant you no right to use them.
What we do not promise
This service is provided free of charge, as is, and without warranties. We work to keep it available and accurate, but do not guarantee that it is uninterrupted or error-free, and we may change or discontinue it.
Published CVE data is provided for information. Deciding whether a vulnerability affects you, and what to do about it, remains yours. We are not responsible for inaccuracies in information supplied to us by third parties.
To the fullest extent the law allows, we are not liable for indirect, incidental, special or consequential loss, including lost profits, lost data, or business interruption. Because this service is free of charge, our total liability for any claim is limited to the minimum the law permits.
Nothing here limits liability that cannot lawfully be limited, including for death or personal injury caused by our negligence, or for fraud. Nothing here limits your rights under consumer protection law that cannot lawfully be excluded.
Indemnification
To the fullest extent the law allows, you agree to hold the EEF and the people acting for it harmless from claims, losses and reasonable legal costs arising from your breach of these terms or your deliberate misuse of the service, including content you submit in breach of them. This does not apply to claims arising from our own negligence, our breach of these terms, or our breach of the law, and is limited where consumer indemnification is restricted.
Data licensing
CVE and OSV data published here is licensed for reuse. The terms are on the Data Licensing page.
The rest
If any part of these terms is held invalid or unenforceable, it is narrowed to the minimum needed to make it work, and the rest stands.
These terms and the Privacy Policy are the whole agreement between you and us about your use of this service.
We may update these terms. The date below says when they last changed, and every previous version is in the page's history.
These terms are effective as of 2026-08-12, and are governed by the law of the State of California, United States, without prejudice to any mandatory consumer protection rights you have where you live. Disputes go before the courts competent under applicable law.