Security Disclosure Program

Tidepool operates a security disclosure program to help external users report bugs and reward open source security researchers for their independent efforts reviewing our code and application. To date, we have had over 45 valid and well-documented bugs reported and many have been prioritized and fixed.

We are grateful for the transparency and additional eyes that are brought to bear on our application. One of the cited strengths of Open Source code has always been Eric S. Raymond’s Linus’s Law, which reads:

"given enough eyeballs, all bugs are shallow".

- Linus's law

While this theory has been argued due to lack of evidence and the acknowledgement that the number of bugs reported does not scale to the number of security reviewers available, there is still no question that there is benefit to providing access to source code not only for collaboration and development but security visibility and transparency. Tidepool believes that open works better than closed in security, and that security-by-obscurity is no security at all.

Tidepool wishes to recognize and thank the following researchers who have reported well-documented application bugs, security concerns, software or infrastructure misconfigurations that could present a risk to Tidepool organization and application security.

Tidepool Security Hall of Fame (HoF)