How ECHOS discloses a vulnerability

ECHOS is a research program at Stonepath IT that searches for vulnerabilities in other software, specifically focusing on self-hosted MCP servers and agent infrastructure. The focus of this report is not on what ECHOS discovers, but rather on the process following the discovery of a vulnerability. The short version of this process is that the maintainer is informed of the flaw first, before the public receives any information.

When a project accepts private reports through GitHub Security Advisories, the report goes through that channel. If no private channel exists, the report is sent via email to the project's address in the project's history. If there is still no response, the report is followed up on and other routes are explored, such as the package's publisher or GitHub's security team.

The vulnerability is also filed with the CVE program through MITRE, ensuring it can carry one name wherever it is tracked. The default embargo for disclosing a vulnerability is 90 days from the initial report, extending when a fix is genuinely underway and shortening only if the issue is actively being exploited. During the embargo period, nothing about the finding is published or hinted at, including on this site.

The Labs page names a quarter for the first advisories but never a specific date, as revealing a date would indicate when an embargo ends. Once the embargo expires, the advisory is published on the Labs page, including reproduction steps, identifiers, and the timeline. The maintainer is credited in the publication, and the timeline ensures the rules are followed.

The disclosure policy for when Stonepath IT's systems are vulnerable is the same, with an address provided for sending reports and a safe harbor for good-faith research. This policy was written before the first advisory, allowing individuals to review the rules before witnessing their application. The original article was published at stonepathit.com.