# \[ANN\] OCaml security team **URL:** \ **Category:** Ecosystem\ **Tags:** security, ocaml, announce\ **Created:** [July 3, 2025, 11:40am UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902 "2025-07-03T11:40:12Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [July 3, 2025, 11:40am UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/1 "2025-07-03T11:40:13Z")
Dear everyone, We are starting an effort to push security into OCaml. This is based on discussions in the OCaml Software Foundation with industry partners. The main goal is to have best practises similar to those of other programming language ecosystems. ## Reporting security issues This entails a point of contact for the security team - which deals with communication between the person who found a security-relevant problem in OCaml software (named “reporter”), who can then contact us - the security team - instead of using a public bug tracker, and the upstream OCaml developer(s). We, the security team, will establish the three-way communication, and since we have a documented security disclosure process (which will be published soon), we will guide everyone through the process and ensure that timelines are met, CVE numbers are assigned, … ## Team composition The OCaml security team currently consists of individual security experts and individuals representing company sponsors of the OCaml Software Foundation. Individual members participating on a personal capacity may be compensated for their time from the OCaml Software Foundation. The team currently consists of 7 members - Hannes Mehnert [hannesm (Hannes Mehnert) · GitHub](https://github.com/hannesm) - individual, chair - Mindy [yomimono (yomimono) · GitHub](https://github.com/yomimono) - individual - Joe [cfcs (C For C's Sake) · GitHub](https://github.com/cfcs) - individual - Edwin Török [edwintorok (Török Edwin) · GitHub](https://github.com/edwintorok) - individual - Nicolás Ojeda Bär [nojb (Nicolás Ojeda Bär) · GitHub](https://github.com/nojb) - LexiFi - Louis Roché [Khady (Louis) · GitHub](https://github.com/khady) - ahrefs - Maxim Grankin [maxim092001 (Maxim Grankin) · GitHub](https://github.com/maxim092001) - Bloomberg We’re in the process to formalise the responsibilities of the team, our proposed disclosure process, and how to join & leave the team. ## Funding for security actions In complement to the security disclosure process, we will accept funding requests for projects that make OCaml more secure (including guidelines how to develop OCaml in a secure way/what are common pitfalls; static analysis; dissemination tools; …). The OCaml Software Foundation will provide funding for these security actions. After this summer we will discuss this in more depth with the community. ## Next steps We will setup a website (similar to what Haskell has at [Security](https://www.haskell.org/security/)) soon, and provide an email address for contacting us - security At ocamlDoT org is forwarding to our team. We will also setup a mailing list for security announcements. But more on that at a later point, this brief post is mainly about the fact that this team starts to exist now, and is working on improving the security story of OCaml. If you have any questions for now, please feel free to discuss them in this announcement. Please be aware that it is vacation time soon, so we may not be very responsive. ---
**Author:** ![avsm](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/avsm/32/6_2.png) [@avsm](https://discuss.ocaml.org/u/avsm)\ **Post date:** [July 3, 2025, 1:40pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/2 "2025-07-03T13:40:38Z")
Pinned on July 3, 2025, 1:40pm UTC ---
**Author:** ![cuihtlauac](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/cuihtlauac/32/3638_2.png) [@cuihtlauac](https://discuss.ocaml.org/u/cuihtlauac)\ **Post date:** [July 10, 2025, 9:47am UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/3 "2025-07-10T09:47:03Z")
> We will set up a website (similar to what Haskell has at Security) soon The [ocaml.org](http://ocaml.org/) maintenance team will happily help hosting the OCaml Security Team pages, maybe at [ocaml.org/security](http://ocaml.org/security). We’d provide support to seamlessly integrate the security team’s content and give it maximum visibility. ---
**Author:** ![cuihtlauac](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/cuihtlauac/32/3638_2.png) [@cuihtlauac](https://discuss.ocaml.org/u/cuihtlauac)\ **Post date:** [September 9, 2025, 4:11pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/4 "2025-09-09T16:11:04Z")
Thanks to @hannes and the OCaml security team, this is now a work in progress at [OCaml security pages by cuihtlauac · Pull Request #3300 · ocaml/ocaml.org · GitHub](https://github.com/ocaml/ocaml.org/pull/3300) ---
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [September 12, 2025, 9:43am UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/5 "2025-09-12T09:43:55Z")
Dear everyone, we’ve accomplished several tasks: - [OCaml Security](https://ocaml.org/security) is now live - The public mailing list for security advisories is [https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements](https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements) – please subscribe if you’d like to receive security announcements - There’ll be a brief introduction at [Fun OCaml](https://fun-ocaml.com) and a talk at [OCaml workshop (ICFP)](https://conf.researchr.org/details/icfp-splash-2025/ocaml-2025-papers/9/Toward-a-More-Secure-OCaml-Ecosystem) )16:00 - 16:30 - We will have a public meeting for discussions on Oct 22nd 14:00 - 16:00 CEST (online, yet to be announced where) – save the date if you’re interested - There’s already the OCaml security advisory database [GitHub - ocaml/security-advisories: Advisories from the OCaml Security team](https://github.com/ocaml/security-advisories) (still empty, we’ll fill it over the next weeks) ---
**Author:** ![yawaramin](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/yawaramin/32/3384_2.png) [@yawaramin](https://discuss.ocaml.org/u/yawaramin)\ **Post date:** [September 12, 2025, 3:42pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/6 "2025-09-12T15:42:38Z")
> [@hannes](#): > > The public mailing list for security advisories is Would it be possible to use the GH page instead? [Security Overview · ocaml/security-advisories · GitHub](https://github.com/ocaml/security-advisories/security) ---
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [September 14, 2025, 6:22pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/7 "2025-09-14T18:22:53Z")
There’ll be as well be a site with the security advisories (link to be done, likely via osv.dev). The mailing list is a push service, while the website is a pull service. ---
**Author:** ![yawaramin](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/yawaramin/32/3384_2.png) [@yawaramin](https://discuss.ocaml.org/u/yawaramin)\ **Post date:** [September 14, 2025, 7:41pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/8 "2025-09-14T19:41:20Z")
OK, just fyi, it’s possible to subscribe to security alerts for a GitHub repo: ![Screenshot 2025-09-14 at 15.41.07](https://us1.discourse-cdn.com/flex020/uploads/ocaml/original/2X/4/419f3f41589246d8e97d2c4867cac29ff015b750.jpeg) ---
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [September 26, 2025, 10:12am UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/9 "2025-09-26T10:12:27Z")
> [@hannes](#): > > We will have a public meeting for discussions on Oct 22nd 14:00 - 16:00 CEST (online, yet to be announced where) – save the date if you’re interested We settled on a platform, and will have the meeting at [Jitsi Meet](https://meet.bornhack.dk/OCamlSecurityPublicMeeting) An agenda will be posted before the meeting. ---
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [October 21, 2025, 6:36pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/10 "2025-10-21T18:36:41Z")
Dear everyone, as a reminder – this is tomorrow at 14:00 CEST (in ~17.5h). We use a pad for the agenda and minutes, you can already write down questions there - we hope to have enough time to cover these. > **[OCaml public security meeting - HedgeDoc](https://pad.data.coop/7-Ic5rG6ToynsW02hJsndg?both)** Have a nice evening. ---
**Author:** ![hannes](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.ocaml.org/hannes/32/2302_2.png) [@hannes](https://discuss.ocaml.org/u/hannes)\ **Post date:** [January 24, 2026, 12:54pm UTC](https://discuss.ocaml.org/t/ann-ocaml-security-team/16902/11 "2026-01-24T12:54:32Z")
Dear everyone, as we discussed in the earlier public meeting, we plan to have every 3 months another one. The next public security meeting is scheduled for Thursday, March 19th 14:00 CET - 16:00 CET. Please put that into your calendar if you plan to attend.