Bristol Myers Squibb
Biopharmaceuticals
Critical 1
Infrastructure and dependency security
Impact proxy: Platform resilience
DisclosedFailSafe Disclosure Program
FailSafe
FailSafe Disclosure Program
The FailSafe Disclosure Program is a public security signal for responsible vulnerability research. We identify issues across open-source repositories and public-facing systems, report them responsibly, and contribute fixes upstream where possible.
Our aim is straightforward: make the software everyone builds on safer, protect the organizations people rely on, and give back to the community.
101
Organizations and projects
240+
Findings disclosed
0
Exploit instructions on this page
Our approach
Share what helps. Withhold what harms.
The program gives back to the open-source community through responsible reports and upstream fixes. The program also covers coordinated disclosures made privately to organizations.
We coordinate timing with maintainers and affected teams. Private disclosures receive public-safe summaries; open-source entries are grouped into simple program-level statuses, with linked upstream records serving as the detailed source of truth.
Disclosure process
How it works
A remediation-first process from discovery to a safe public record.
- 01
Identify
We identify security weaknesses in open-source repositories and public-facing systems.
- 02
Notify
We notify the security or engineering team directly with full details.
- 03
Remediate
We support maintainers and affected teams as they validate and fix the issue.
- 04
Publish
We record a public-safe summary or link the upstream contribution when appropriate.
Disclosure program
Responsible disclosures
Summaries are deliberately limited to information that cannot be used to reproduce or exploit a finding.
Publication note: Research areas are intentionally broad. Our summaries omit affected systems, exploit paths, personal data types, credentials, and other details that could increase risk. Public open-source entries link to their upstream records. Inclusion is not a commercial relationship or endorsement.
101 resultsPage 1 / 7
| Organization | Sector | Findings | Severity | Finding types | Impact proxy | Status |
|---|---|---|---|---|---|---|
| Bristol Myers Squibb | Biopharmaceuticals | 1 | Critical 1 | Infrastructure and dependency security | Platform resilience | Disclosed |
| IBM MCP Context Forge | AI infrastructure | 2 | Critical 1High 1 | Secrets policy · Authentication controls | Account and access security | In progress |
| Deutsche Bank | Banking | 2 | Critical 1High 1 | Data protection · Infrastructure security | Data confidentiality · Platform resilience | Disclosed |
| MUFG | Banking | 3 | High 2Medium 1 | Identity and access · Application logic | Account and access security · Application integrity | Disclosed |
| BCA | Banking | 1 | High 1 | Secrets management | Account and access security | Disclosed |
| Zurich Insurance | Insurance | 1 | High 1 | Identity and access | Account and access security | Disclosed |
| Sun Pharma | Pharmaceuticals | 3 | Critical 1High 2 | Secrets management · Data protection | Data confidentiality · Account and access security | Disclosed |
| Swiss Re | Reinsurance | 2 | High 2 | Application data protection · Identity security | Data confidentiality · Account and access security · Application integrity | Remediated |
| Liberty Mutual | Insurance | 1 | High 1 | Identity and web security | Account and access security · Application integrity | Disclosed |
| Dr. Reddy's | Pharmaceuticals | 2 | Critical 1High 1 | Data access control · Web application security | Data confidentiality · Account and access security · Application integrity | Disclosed |
| Base | Blockchain infrastructure | 3 | High 3 | Transaction authorization · Infrastructure security · Administrative access control | Account and access security · Platform resilience · Transaction and trust integrity | In progress |
| OKX Wallet Core | Web3 infrastructure | 3 | Not rated 3 | Signature validation · Transaction authorization | Account and access security · Transaction and trust integrity | In progress |
| Vercel | Developer infrastructure | 1 | High 1 | Request routing · Execution safeguards | Application integrity | In progress |
| InMobi | Advertising technology | 1 | High 1 | Secrets management · Software supply chain | Account and access security · Platform resilience | Disclosed |
| EnergyAustralia | Energy | 1 | Medium 1 | Transport security · Customer portal security | Platform resilience | Disclosed |
1 finding
IBM MCP Context Forge
AI infrastructure
Critical 1High 1
Secrets policyAuthentication controls
Impact proxy: Account and access security
In progressDeutsche Bank
Banking
Critical 1High 1
Data protectionInfrastructure security
Impact proxy: Data confidentiality · Platform resilience
DisclosedMUFG
Banking
High 2Medium 1
Identity and accessApplication logic
Impact proxy: Account and access security · Application integrity
DisclosedBCA
Banking
High 1
Secrets management
Impact proxy: Account and access security
DisclosedZurich Insurance
Insurance
High 1
Identity and access
Impact proxy: Account and access security
DisclosedSun Pharma
Pharmaceuticals
Critical 1High 2
Secrets managementData protection
Impact proxy: Data confidentiality · Account and access security
DisclosedSwiss Re
Reinsurance
High 2
Application data protectionIdentity security
Impact proxy: Data confidentiality · Account and access security · Application integrity
RemediatedLiberty Mutual
Insurance
High 1
Identity and web security
Impact proxy: Account and access security · Application integrity
DisclosedDr. Reddy's
Pharmaceuticals
Critical 1High 1
Data access controlWeb application security
Impact proxy: Data confidentiality · Account and access security · Application integrity
DisclosedBase
Blockchain infrastructure
High 3
Transaction authorizationInfrastructure securityAdministrative access control
Impact proxy: Account and access security · Platform resilience · Transaction and trust integrity
In progressOKX Wallet Core
Web3 infrastructure
Not rated 3
Signature validationTransaction authorization
Impact proxy: Account and access security · Transaction and trust integrity
In progressVercel
Developer infrastructure
High 1
Request routingExecution safeguards
Impact proxy: Application integrity
In progressInMobi
Advertising technology
High 1
Secrets managementSoftware supply chain
Impact proxy: Account and access security · Platform resilience
DisclosedEnergyAustralia
Energy
Medium 1
Transport securityCustomer portal security
Impact proxy: Platform resilience
DisclosedContact the Disclosure Program
If your organization or project has received a FailSafe disclosure disclosure and you'd like to coordinate remediation, update a listing, or request removal, contact our security team.
[email protected]Questions & answers
Frequently asked questions
How the FailSafe Disclosure Program coordinates, publishes, and maintains responsible disclosures.
The FailSafe Disclosure Program is a public-good program for safe summaries of coordinated vulnerabilities in open-source repositories and public-facing systems.
FailSafe identifies a security weakness, notifies the relevant maintainers or security team privately, supports remediation, and publishes a safe record when appropriate.
No. Private disclosure summaries deliberately omit affected systems, exploit paths, personal data types, credentials, and other details that could increase risk.
The Disclosure Program uses four program-level statuses: Remediated for confirmed fixes, Completed for concluded upstream work, In progress for active upstream review, and Disclosed when a safe public record exists without a confirmed remediation outcome.
Contact [email protected] to coordinate remediation, correct a listing, or request removal from the public program.