Orval Vulnerability Disclosure

generated: '2026-08-06'
method: searched
probe: true
source: https://github.com/orval-labs/orval/blob/master/SECURITY.md
description: >-
  Orval publishes a written security policy in the repository root (SECURITY.md)
  covering supported versions, how to report privately, what to include, the
  response process, and coordinated disclosure. Reporting runs through GitHub
  Security Advisories rather than an email alias or a bug-bounty platform.
policy:
  - https://github.com/orval-labs/orval/blob/master/SECURITY.md
reporting_channel:
  - kind: github-security-advisories
    url: https://github.com/orval-labs/orval/security/advisories
    private: true
contact: []
contact_note: >-
  No security@ alias published. SECURITY.md says reporters "may contact the
  maintainers privately via email if listed in the repository" — no address is
  listed, so the advisories form is the only stated channel.
bug_bounty:
  published: false
  platform: null
response_targets:
  acknowledgement: within 72 hours
disclosure_process:
  coordinated: true
  steps:
    - Do not open a public issue.
    - Report via GitHub Security Advisories.
    - Maintainers acknowledge within 72 hours, then investigate and validate.
    - If accepted, a fix is developed and disclosure is coordinated.
    - A GitHub Security Advisory may be published on release.
    - The vulnerability is documented in the release notes.
    - Reporter is credited unless anonymity is requested.
supply_chain_practices:
  - practice: Socket.dev dependency check on bun install
    added_in: 8.15.0
    source: https://github.com/orval-labs/orval/releases/tag/v8.15.0
  - practice: GitHub code scanning; workflow permissions hardened
    added_in: 8.16.0
  - practice: Dependabot dependency bumps in the release stream
  - practice: >-
      External $ref resolution gated behind an explicit allow-list as a security
      fix (a deliberate breaking change)
    added_in: 8.22.0
security_txt:
  published: false
  probed: https://orval.dev/.well-known/security.txt
  http_status: 404
evidence:
  - source: https://raw.githubusercontent.com/orval-labs/orval/master/SECURITY.md
    kind: security-policy
    http_status: 200
  - source: https://github.com/orval-labs/orval/security/advisories
    kind: advisories
    http_status: 200
  - source: https://orval.dev/.well-known/security.txt
    kind: security.txt
    http_status: 404
x-evidence:
  fetched: '2026-08-06'
  note: >-
    0-working/probe-security-programs.py reported vdp=none because it only
    probes the web host (orval.dev); the policy lives on the GitHub repo, which
    was fetched directly.