Follow-up: security report sent to info@greptime.com — no response yet

[YZL0v3ZZ]

Hi GreptimeDB Security Team,

I'm following up on the security report I sent to info@greptime.com on 09/23/2026. Could you please confirm receipt, or let me know if I should use another private channel?

I can provide the details again via a secure method if needed.

Thanks,
YZL0v3ZZ

[killme2008]

Hi, we didn’t receive this email. Could you please provide the subject line or other details so we can look into it?

[YZL0v3ZZ]

Hi @killme2008 ,

Thanks for getting back to me.

The subject line looks like these:
[Private Disclosure] Undefined behavior in GreptimeDB vector aggregates: binlit_as_veclit accepts unaligned bytes (vec_sum / vec_avg / vec_product)
[Private Disclosure] GreptimeDB prom_validation_mode = "unchecked": invalid UTF-8 Strings (UB) and WAL entries the server cannot replay
[Private Disclosure] GreptimeDB PromQL range arrays: dictionary keys used as unchecked indices (safe-API out-of-bounds reads, plus operator panics on the same input)
[Private Disclosure] GreptimeDB vector accessors treat is_valid() as a bounds check (Vector::get / get_ref out-of-bounds reads through safe APIs)

It may have been filtered as spam or quarantined.

[killme2008]

@YZL0v3ZZ Thanks—they ended up in spam. Could you report them here? https://github.com/GreptimeTeam/greptimedb/security/advisories/new

Thanks for your time.