Security Advisories
ONE WARE publishes an advisory when a security issue in one of our products requires you to act — typically by updating, or by changing a configuration.
Where advisories are published
| Product | Advisory source |
|---|---|
| ONE WARE Studio | github.com/one-ware/OneWare/security/advisories |
| OneWare.AI extension | Release notes, in-product notification, and direct notice to affected customers |
| OneWare Self-Hosted Worker | Direct notice to deployment contacts, and release notes for the worker image |
| Hosted ONE WARE Cloud | Service status and direct notice to affected accounts |
Advisories for issues discovered in third-party components are published only where the component is part of a ONE WARE product and the issue affects you in practice. We do not republish upstream advisories that do not.
How to receive notifications
Choose at least one. Do not rely on periodically checking this page — urgent notices are pushed, not posted.
1. Watch the ONE WARE Studio repository. On github.com/one-ware/OneWare, select Watch → Custom → Security alerts. This covers the open-source desktop application.
2. Register a security contact. For commercial products — the OneWare.AI extension, the Self-Hosted Worker and the hosted Cloud — send a monitored contact address to security@one-ware.com with the subject Security contact registration, stating:
- your organisation,
- the products and versions you run,
- a monitored email address (a shared team mailbox is better than an individual).
We use this list to notify you directly for High and Critical issues. This is the only channel that reaches you reliably for the self-hosted worker, because we have no telemetry that tells us who is running it.
3. Keep your deployed versions recorded. An advisory names affected versions. If you do not know what you are running, you cannot tell whether it applies to you.
What an advisory contains
Each advisory states:
- affected products and version ranges,
- a description of the issue and its impact,
- severity, with a CVSS score where one applies,
- the fixed version, or a mitigation if no fix is available yet,
- the action you need to take, and by when,
- a CVE identifier where one has been assigned.
Response expectations
Our targets for handling a report are on the Product Security page. Once a fix is available:
| Severity | Our target to publish and ship a fix | Suggested target for you to deploy |
|---|---|---|
| Critical | As soon as a tested fix exists | Within 72 hours |
| High | Promptly, prioritised over feature work | Within 7 days |
| Medium | In the next scheduled release | With your normal update cycle |
| Low | In a future release | With your normal update cycle |
Where a fix cannot be delivered quickly, we publish a mitigation first and the fix when it is ready, rather than staying silent.
Coordinated disclosure
We follow coordinated vulnerability disclosure. We publish an advisory once a fix or a workable mitigation is available, and we credit reporters who ask for acknowledgement.
If a vulnerability is being actively exploited, we may publish earlier — the priority is giving you the information you need to protect yourself, even if that is only a mitigation.
Reporting a vulnerability
See Product Security, or email security@one-ware.com with the subject Security. Please do not report vulnerabilities through public issues, Discord, or general support channels.
Related
- Product Security — reporting policy and response targets
- Product Lifecycle and Security Updates — support periods
- Self-Hosted Worker Security — operator responsibilities