Security policy

Report a vulnerability

apache/maven-reporting-api follows the Apache Software Foundation security process. Report suspected vulnerabilities privately to security@apache.org; do not open public GitHub issues or pull requests for security reports.

Threat model

What the project treats as in scope and out of scope, the security properties it provides and disclaims, the adversary model, and how findings are triaged are documented in https://github.com/apache/maven/blob/master/THREAT_MODEL.md.