We're doing our best to protect our community from all harm, therefore we take security vulnerabilities very seriously.

If you believe that you've found one, we'd appreciate if you let us know about it. You can do so by contacting us privately at [email protected], where we'll do our best to evaluate your issue ASAP and keep you updated with the development status. If your vulnerability isn't crucial and doesn't result in a direct escalation, therefore can be known publicly while the appropriate fix is being implemented, you can also open a standard issue instead.

Depending on the severity of the issue, we might take further actions in order to limit potential damage, for example by speeding up the release of the next stable ASF version. This is evaluated on a case-by-case basis.