mirror of
https://github.com/apache/kafka.git
synced 2026-10-28 08:24:58 +08:00
Christo Lolov
a5c31c4ac6
This starting point has been inspired by other security models of Apache projects such as [Apache Tomcat](https://tomcat.apache.org/security-model.html) and [Apache Spark](https://spark.apache.org/docs/latest/security.html). Reviewers: Mickael Maison <mimaison@apache.org>
1.7 KiB
1.7 KiB
Security Policy
Reporting a Vulnerability
Report suspected security vulnerabilities privately to security@kafka.apache.org,
following the ASF security process. Do not
open public GitHub issues or pull requests, file public JIRA tickets, or post to
mailing lists for unpatched vulnerabilities.
Disclosed CVEs and their affected version ranges are published at kafka.apache.org/cve-list.
Security Model
What is in and out of scope, how reports are classified, and the list of known non-findings are documented in the Apache Kafka security model under docs/security/:
- Core model: docs/security/security-model.md
- Kafka Connect: docs/security/security-model-connect.md
- Kafka Streams: docs/security/security-model-streams.md