Advisories for vulnerabilities in the platform that reached a release, whether we found them or you did, with affected versions, severity, and what you need to do.
Incident notices for security incidents affecting the service, published after resolution.
Severity uses the same five-level scale as findings in the product, so a High here means what a High means everywhere else. Publication is timed to a fix being available rather than deployed everywhere, because there may be something for you to do.
The full detail - what gets a bulletin, target timelines per severity, what a bulletin contains - is in the security bulletin policy.
If you check back and nothing has been published, that means no advisories met the policy's criteria in that period. It does not mean nothing was found.
We say so explicitly because a quiet advisory feed is easy to read as an absence of diligence, and because a policy describing only what happens when something is found tells you nothing about the other case.
If you believe you have found a vulnerability in the platform, contact support@purpleteamsoftware.com.
Please give us a reasonable period to investigate and fix before disclosing publicly. We will keep you informed, and we will credit you in the bulletin unless you would rather we did not.
The policy page plus this feed is our vulnerability
communication process, in public, with no request required. The equivalent for change
communication is the release note policy and
/release-notes/manifest.json.