Astera Labs Vulnerability Disclosure

generated: '2026-08-06'
method: searched
probe: true
source: https://www.asteralabs.com/resources/security/
policy:
- https://www.asteralabs.com/resources/security/
contact: []
contact_note: >-
  The page instructs reporters to "email your report to the Astera Labs Product
  Security Team" but renders the address as an obfuscated "*protected email*"
  placeholder in the served HTML, so no machine-readable reporting address is
  published. There is no /.well-known/security.txt (RFC 9116) on any Astera Labs
  host.
program:
  team: Product Security Incident Response Team (PSIRT)
  model: Coordinated Vulnerability Disclosure (CVD)
  cna_process: true
  scoring: CVSS v4.0
  identifiers: CVE
  embargo: >-
    "While some disclosures may follow the standard 90-day embargo period,
    others may require more time due to factual circumstances."
  bug_bounty: false
  researcher_credit: >-
    Researchers who privately submit a valid report and follow CVD practices may
    be acknowledged in a published Astera Labs security bulletin.
  scope: Astera Labs hardware and software product portfolio
report_requirements:
- Name and version of the affected product or software
- Detailed instructions to replicate the vulnerability
- Proof-of-concept or exploit code
- Description of how the issue was found, the impact and any potential remediation
- Potential implications of the concern
- Public disclosure plans
gaps:
- id: no-security-txt
  detail: >-
    /.well-known/security.txt returns 404 on www.asteralabs.com; the policy is
    human-readable only and cannot be discovered by a scanner or agent.
- id: obfuscated-contact
  detail: >-
    The PSIRT reporting address is replaced with a "*protected email*"
    placeholder in the HTML, so the reporting channel is not machine-readable.
- id: no-published-bulletins
  detail: >-
    The policy references a "published security bulletin", but no bulletin index
    was found (/resources/security-bulletins/ 404, /security-bulletin/ 404).
evidence:
- source: https://www.asteralabs.com/resources/security/
  kind: vulnerability-disclosure-policy
  http_status: 200
  keywords: [psirt, coordinated vulnerability disclosure, cve, cvss v4.0, responsible
      disclosure]
- source: https://www.asteralabs.com/.well-known/security.txt
  kind: security.txt
  http_status: 404
x-evidence:
  fetched: '2026-08-06'
  url: https://www.asteralabs.com/resources/security/
  http_status: 200
  content_type: text/html
  note: >-
    Found by search, not by the automated probe — probe-security-programs.py
    checks /security, /responsible-disclosure and /vulnerability-disclosure, and
    Astera Labs publishes this at /resources/security/ (bare /security 302s to a
    JPEG asset).