Support windows
How long each product is supported, and whether the vendor has said so at all. Under CRA Art. 13(8) an upstream vendor's silence is not a defence — it becomes the manufacturer's problem.
3declare less than the 60-month CRA floor
1ship software and declare no window at all
5of 20 ship an installable product; the rest are services
Of the 5 products you install, the other 15 being services with no window to declare:
| Vendor | Product | Support period | vs CRA floor | State | Source |
|---|---|---|---|---|---|
| Sentry | Self-hosted Sentry | — | — | Not declared | develop.sentry.dev |
| Atlassian | Data Center releases | 24 months | −36 mo | Declared | confluence.atlassian.com |
| GitHub | GitHub Enterprise Server | 13 months | −47 mo | Declared | docs.github.com |
| MongoDB | MongoDB Server 8.0 | 60 months | meets | Declared | mongodb.com |
| Zoom | Zoom Workplace desktop and mobile app | 9 months | −51 mo | Declared | support.zoom.com |
| Cloudflare | Cloudflare (SaaS) | — | — | Service only | cloudflare.com |
| Datadog | Datadog (SaaS) | — | — | Service only | datadoghq.com |
| Figma | Figma (SaaS) | — | — | Service only | figma.com |
| HubSpot | HubSpot (SaaS) | — | — | Service only | hubspot.com |
| Intercom | Intercom (SaaS) | — | — | Service only | intercom.com |
| Mailchimp | Mailchimp (SaaS) | — | — | Service only | mailchimp.com |
| Miro | Miro (SaaS) | — | — | Service only | miro.com |
| Notion | Notion (SaaS) | — | — | Service only | notion.so |
| OpenAI | OpenAI API (SaaS) | — | — | Service only | openai.com |
| Slack | Slack (SaaS) | — | — | Service only | slack.com |
| Snowflake | Snowflake (SaaS) | — | — | Service only | snowflake.com |
| Stripe | Stripe API (SaaS) | — | — | Service only | stripe.com |
| Twilio | Twilio API (SaaS) | — | — | Service only | twilio.com |
| Vercel | Vercel (SaaS) | — | — | Service only | vercel.com |
| Zendesk | Zendesk (SaaS) | — | — | Service only | zendesk.com |
On a narrow screen this table shows the answer only. Plan, source and date are on each vendor's own page.
Why a blank matters. CRA Art. 13(8) sets a five-year support floor and requires updates to remain available for ten. It makes the support window the manufacturer's responsibility — so an upstream component whose vendor has never declared one does not excuse you, it becomes your exposure. "Not declared" is the finding, not the absence of one.
"Service only" is not a pass mark. Most vendors here are pure services with nothing for you to run, so no support window attaches to them and the column is blank because the question does not apply. That is different from a vendor that ships software and says nothing — and mixing the two would invent a failing. Whether the Article binds any particular product depends on how it is placed on the market, which is your assessment to make, not ours.
Security contacts
Where a vendor publishes /.well-known/security.txt (RFC 9116), that is the machine-readable route for reporting a vulnerability to them. The standard makes an Expires field mandatory; a file without one, or one long past its date, is a file nobody is maintaining.
| Vendor | Reporting route | security.txt |
|---|---|---|
| Sentry | security@sentry.io | no Expires field (RFC 9116 requires one) |
| Atlassian | atlassian.com | expires 2027-02-04 |
| GitHub | hackerone.com | expires 2026-10-18 |
| MongoDB | none published | none at the well-known path |
| Zoom | zoom.com | expires 2029-12-31 |
| Cloudflare | hackerone.com | no Expires field (RFC 9116 requires one) |
| Datadog | none published | none at the well-known path |
| Figma | hackerone.com | expires 2026-10-21 |
| HubSpot | security-notifications@hubspot.com | expires 2034-06-01 |
| Intercom | bugcrowd.com | expires 2029-03-15 |
| Mailchimp | mailchimp.com | no Expires field (RFC 9116 requires one) |
| Miro | security@miro.com | expires 2030-12-30 |
| Notion | notion.so | expires 2030-01-01 |
| OpenAI | bugcrowd.com | no Expires field (RFC 9116 requires one) |
| Slack | hackerone.com | no Expires field (RFC 9116 requires one) |
| Snowflake | security@snowflake.com | expires 2027-08-17 |
| Stripe | hackerone.com | expires 2026-12-31 |
| Twilio | none published | none at the well-known path |
| Vercel | hackerone.com | expires 2027-05-27 |
| Zendesk | zendesk.com | expires 2027-04-16 |