How ECHOS discloses a vulnerability

ECHOS is the research program at Stonepath IT. It looks for vulnerabilities in other people’s software, and its focus is self-hosted MCP servers and agent infrastructure. This post is not about what it finds. It is about what happens after it finds something.

The short version: the maintainer hears first, the public hears last, and nothing is published in between.

The maintainer hears first

When ECHOS finds a flaw, the vendor or maintainer hears about it from us, privately, before anyone else does.

Where a project accepts private reports through GitHub Security Advisories, the report goes there. A GitHub advisory starts as a private report to the project’s maintainers and becomes public when the issue is disclosed.

Not every project has a private channel. When one does not, the report goes by email to the address in the project’s history. If no response comes, we follow up, then try other routes, such as the package’s publisher or GitHub’s security team. The finding is also filed with the CVE program through MITRE, which is private too, so it can carry one name wherever it is tracked.

The clock is 90 days

The default embargo is 90 days from first report. It extends when a fix is genuinely underway and shortens only if the issue is being actively exploited.

A maintainer who is fixing the problem gets the time to finish. A flaw that someone is already using against people does not wait for the calendar.

Nothing leaks in between

Until its embargo expires, nothing about a finding is published or hinted at. That rule covers this site too. We do not say which project, what kind of bug, or when a given advisory will land.

It is why the Labs page names a quarter for the first advisories and never a date. A date would tell a careful reader which embargo ends when.

What publishes

When the embargo ends, the advisory goes up on the Labs page. Each one ships with the reproduction, the identifiers it was filed under, and the timeline. The maintainer is credited in it.

The timeline is the part that keeps us honest. Anyone can read it and check that the rules above were kept.

If you find one in ours

The same rules run the other way. If you find a vulnerability in a system Stonepath IT runs, the disclosure policy has the address to send it to and the safe harbor for good-faith research.

The policy was written down before the first advisory, so you can read the rules before you see us use them.