Report a vulnerability upstream

When a manufacturer finds a vulnerability in a component, Article 13(6) has them report it to whoever maintains the component and, where they develop a fix, share it with them. Declara keeps the record of who you told, when, and what came of it. It sends nothing. You report through the maintainer's own channel.

Before you start

• Any plan. The upstream log is not plan-gated.
• A member, admin or owner role (cases.write).
• The maintainer's security contact, from their security.txt, SECURITY.md, issue tracker or website.

Steps

1. Start a report from a case, an alert or a report received on your disclosure page, with Report upstream. You can also open Inventory, then Upstream reports, and start one without a source. The package is chosen from what your supported versions ship; the ones the linked alert matched come first.
2. Enter who you are reporting to, where you found the contact (a security.txt, a SECURITY.md, an email address, an issue tracker, or somewhere else), and optionally a link and notes. Press Save as a draft.
3. Press Check for duplicates.
4. Send the report by the maintainer's channel, then press Mark as reported and give the day. The day is read in your workspace's time zone.
5. As things develop, mark it Acknowledged, Fixed upstream or Declined. When you have passed a fix to the maintainers, press Record that the fix was shared and add a link if you have one.

The duplicate check is a hint

The check looks at advisories Declara holds. It lists those that share an identifier with the advisory you linked, and those that name the same package. A match is a prompt to look at the maintainer's tracker before you send. No match does not mean the maintainer has not been told: Declara does not see private reports or trackers. When more advisories name the package than fit, the page says it shows the most recent only.

Statuses

What is left out

Practice cases (drills) cannot be reported upstream, and are excluded from the log, from the authority pack and from the technical file. Nothing was found, so nothing is reported.

Where it shows up

The report appears under Upstream reports, as a count in the technical file's section 2 ("Vulnerabilities reported upstream (Art. 13(6))"), and in a market-surveillance pack as records/upstream-reports.json.

Primary source

• Article 13(6) of Regulation (EU) 2024/2847 on EUR-Lex, checked 2026-10-10: on identifying a vulnerability in an integrated component, report it to the person or entity manufacturing or maintaining the component, and share any fix you develop, where appropriate in a machine-readable format.

Related

• Review a third-party component
• Run an Article 14 drill