DO NOTdiscuss on a mailing list - especially one with an open subscription policy or public archive
DO NOTpost information on a web page
DO NOTpublicise in any way - e.g. to the media
IMMEDIATELY Report it to report-vulnerability (at) egi.eu
This can also be used to alert the SVG to issues announced publicly which are likely to be relevant to the EGI infrastructure.
If you have accidentally released information publicly
Let us know, and get it removed if possible, e.g. if you have put details on a public web page - please delete it.
Help and co-operate with the investigation
While there is no obligation to help with the investigation, it is often extremely helpful if the person who finds a vulnerability is able to assist with the investigation.
The reporter receives information
The SVG will let the reporter know the outcome of the investigation and risk assessment, including the risk category and Target Date for resolution. The reporter will receive a copy of the advisory, if one is issued.