_layouts/security.html

---
layout: default
---
<!--
# Licensed to the Apache Software Foundation (ASF) under one or more contributor
# license agreements; and to You under the Apache License, Version 2.0.
-->
<div id="whiskIndexedLayout">

    <!-- Community Index -->
    <div id="whiskIndex">
        <ul>
            <li><a href="#report">Security</a></li>
            <li><a href="#report">Report a security vulnerability</a></li>

        </ul>
    </div>

    <section id="whiskNodes">
        <main class="doc">
            <div class="content">
                <a class="indexable" id="downloads"></a>
                <h2>Security</h2>
                <div class="collapsible-content">
                    <p>This page contains information on how to report a security vulnerability within the Apache OpenWhisk project.</p>
                </div>
            </div>
        </main>

        <main class="doc">
            <div class="content">
                <a class="indexable" id="report"></a>
                <h3>Report a security vulnerability</h3>
                <div class="collapsible-content">
                    <p>We encourage following the Apache <a href="http://www.apache.org/security/#reporting-a-vulnerability">Vulnerability Reporting</a> process for reporting suspected security vulnerabilities rather than disclosing them in a public forum.</p>
                    <p>In short, the person discovering the issue, the reporter, should notify the Apache Security team with details of the suspected vulnerability by sending an email to <a href="mailto:security@apache.org">security@apache.org</a>.</p>
                    <p>The Apache security team will notify the Apache OpenWhisk Project Management Committee (PMC) and work with them and the submitter to address the issue as described by the Apache <a href="https://www.apache.org/security/committers.html#vulnerability-handling">Vulnerability Handling</a> process.</p>
                    <p>Please note that this mailing list should only be used for reporting undisclosed security vulnerabilities for Apache OpenWhisk code or dependent libraries, runtimes and tooling.  Bug reporting should be done by opening a GitHib Issue within the corresponding project repository where a bug is suspected.</p>
                </div>
            </div>
        </main>
    </section>

</div>