Reporting a vulnerability
Report it privately through GitHub: open the repository’s Security tab and choose Report a vulnerability.
Include the affected version, what an attacker could do (for example, “an admin of tenant A can read tenant B”), and steps or code to reproduce it.
What happens next
Section titled “What happens next”| Stage | Target |
|---|---|
| Acknowledgement | within 2 business days |
| Assessment and severity | within 5 business days |
| Fix for critical or high severity | within 14 days of confirmation |
| Fix for medium or low severity | the next scheduled release |
Fixes are published as security advisories and to the Go vulnerability database, so govulncheck warns every affected product. Reporters are credited unless they prefer otherwise.
The full policy is SECURITY.md.
Questions about this page?
Ask below, point out something wrong or unclear, or suggest an improvement. Reading needs no account; to post, sign in with GitHub.