Trust Center

After careful review of our infrastructure and npm dependencies, the Rootly team has determined that we are not currently impacted by the recent NPM supply chain attack disclosed on September 8, 2025, which compromised several widely used packages (e.g., debug, chalk).

For reference, please see the advisory.

We will continue to monitor for any updates and ensure our systems remain secure.

After careful review of our infrastructure and SBOM, the Rootly team has determined that we are not currently vulnerable to the xz Vulnerability CVE-2024-3094 that were disclosed on March 29th, 2024.

After careful review of our infrastructure and SBOM, the Rootly team has determined that we are not currently vulnerable to the MOVEit Transfer Critical Vulnerability CVE-2023-34362 that were disclosed on June 16th, 2023.

After careful review of our infrastructure and SBOM, the Rootly team has determined that we are not currently vulnerable to the OpenSSL 3 vulnerabilities CVE-2022-3602 and CVE-2022-3786 that were disclosed on November 1, 2022.

None of our services are running Java 15, 17, and 18 so this vulnerability (CVE-2022-21449) is not exploitable on our side.