community/security.md

---
title: Security Vulnerability Disclosure
language: en
description: "How to report security vulnerabilities to Apache Doris: contact the ASF Security Team via security@apache.org and follow the official responsible disclosure process."
keywords:
    - Apache Doris security
    - Doris security vulnerability
    - security@apache.org
    - ASF Security Team
    - responsible disclosure
    - vulnerability report
    - CVE
---

<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->

# Security Vulnerability Disclosure

<!-- Knowledge type: Procedure -->
<!-- Applicable scenario: Vulnerability reporting / Security disclosure -->

The Apache Software Foundation (ASF) takes a strict stance on security issues in its software projects. Apache Doris also pays close attention to security issues related to product features and functionality. This page describes how to report security vulnerabilities or potential threats to Doris through the official ASF process.

## Reporting Channel Quick Reference

| Item | Description |
|------|------|
| Recipient | [Apache Security Team](http://www.apache.org/security/) |
| Email address | [security@apache.org](mailto:security@apache.org) |
| Project name | Always specify `Doris` in the email |
| Disclosure principle | **Do not disclose** the vulnerability through any public channel before submitting the email |

## Reporting Steps

<!-- Knowledge type: Procedure -->

1. **Compose the email**: Send it to [security@apache.org](mailto:security@apache.org), and make sure the subject and body clearly identify the project name as `Doris`.
2. **Describe the issue**: Clearly state the impact scope, affected versions, and possible attack scenarios of the vulnerability or potential threat.
3. **Attach reproduction steps**: Provide minimal reproduction steps, a PoC, or log snippets that reproduce the security issue.
4. **Wait for a reply**: The Apache Security Team and the Doris community will contact you directly after evaluation and analysis.

## Important Notes

- **Do not disclose publicly**: Do not discuss the vulnerability on any public channel, including GitHub Issues, mailing lists, Slack, or social media, before receiving a reply from the security team and coordinating a disclosure window.
- **Do not use the regular feedback channels**: Security issues must not be submitted through GitHub Issues or the dev mailing list described in [Feedback](feedback).
- **Follow responsible disclosure**: For the full process, see the [ASF Security Disclosure Policy](http://www.apache.org/security/).

## Related Links

- [ASF Security Team Home](http://www.apache.org/security/)
- [Feedback](feedback): Channel for non-security issues.
- [Join the Community](join-community): Other community communication channels.