Security report — email follow-up

[hyuunnn]

Hi,

I recently sent a security vulnerability report to oss@gchq.gov.uk, but I haven't received a response yet. Could someone confirm whether the email was received?

I'd prefer to share the details privately through the appropriate security contact rather than posting them publicly here.

Thanks.

[HackingRepo]

hi, @hyuunnn

i submitted also 2 security reports still no response at all

[HackingRepo]

@GCHQDeveloper581 and @C85297 that is a big problem with the security list, we want report vulnerability button directly in the Security Tab better, can you do that

[C85297]

Thank you for alerting us. I'm chasing this urgently. Separately we've been working in the background on improving this process and we will continue that work.

[HackingRepo]

ok, what do you mean? i not understanded you

[C85297]

Hi @hyuunnn @HackingRepo sorry for the confusion.
We have now enabled CyberChefSecurity@gchq.gov.uk - could you please forward any security vulnerability reports to that address?

[C85297]

Hi @HackingRepo , the only vulnerability report emails I am able to see from you are one on May 25 2026 ( #2556 ), and a second on May 21 2026 (which we are still looking at). If you've sent any new vulnerability reports, we have not received them.

[HackingRepo]

hi, @C85297 @GCHQDeveloper581, i resended it, now you should receive, if not that is weird

[HackingRepo]

i still not get any response, i do'nt known, what happend again i used the CyberChefSecurity@gchq.gov.uk whiches correct

[no-usernames-left]

i still not get any response, i do'nt known, what happend again i used the CyberChefSecurity@gchq.gov.uk whiches correct

The address originally mentioned was cyberchef@gchq.gov.uk — did you try that one?

@C85297 Some cleanup is urgently needed here

[HackingRepo]

i sended it, @no-usernames-left, ok let's see to cyberchef@gchq.gov.uk now

[GCHQDeveloper581]

@HackingRepo cyberchefsecurity@gchq.gov.uk is the correct address, but I've just checked and nothing has come through. I also sent a mail from an external address and that got through so it's definitely receiving outside emails.

[HackingRepo]

ok @GCHQDeveloper581 and @C85297 i replied to the email i received it, now, do you see something? you should now

[GCHQDeveloper581]

@HackingRepo Still not seeing anything - I'm guessing there's something about the email that is causing it to be blocked. I have temporarily turned on Private Vulnerability Reporting for the repo so you can report via that route.

(Go to the Security & Quality tab of the repo and click the "Report a Vulnerability" button)

(note that this is not the preferred mechanism for reporting Security issues as it is seen by fewer people, so others - please email CyberChefSecurity@gchq.gov.uk as per SECURITY.md guidance)

[HackingRepo]

ok now, you should receive the third report, @GCHQDeveloper581?

[GCHQDeveloper581]

Yes, I can see that one.