| <!-- | |
| Licensed to the Apache Software Foundation (ASF) under one or more | |
| contributor license agreements. See the NOTICE file distributed with | |
| this work for additional information regarding copyright ownership. | |
| The ASF licenses this file to You under the Apache License, Version 2.0 | |
| (the "License"); you may not use this file except in compliance with | |
| the License. You may obtain a copy of the License at | |
| https://www.apache.org/licenses/LICENSE-2.0 | |
| Unless required by applicable law or agreed to in writing, software | |
| distributed under the License is distributed on an "AS IS" BASIS, | |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| See the License for the specific language governing permissions and | |
| limitations under the License. | |
| --> | |
| # Security policy | |
| ## Reporting a vulnerability | |
| Report suspected security vulnerabilities in Apache Roller privately to the | |
| Apache Security Team at [security@apache.org](mailto:security@apache.org). | |
| Please do **not** report them in the public issue tracker, in GitHub issues or | |
| pull requests, or on the public mailing lists. | |
| A useful report says which Roller version you tested, how the site is | |
| configured in any way that matters to the issue, and what steps reproduce the | |
| behaviour. If you are not sure whether what you found is a vulnerability, | |
| report it privately anyway and we will work it out with you. | |
| The Apache Security Team forwards the report to the Roller PMC. See the | |
| [ASF security page](https://www.apache.org/security/) for the foundation-wide | |
| process. | |
| ## Security model | |
| The [Roller security model](docs/security-model.md) explains who Roller trusts, | |
| what each kind of user may do, and what counts as a vulnerability. Please read | |
| it before you report. | |
| ## Supported versions | |
| Security fixes are made on the current release line and shipped in a new | |
| release. Older releases are not patched. If you run an older version, upgrade | |
| to the [current release](https://roller.apache.org/downloads/downloads.html). | |
| ## Advisories | |
| Advisories are listed at <https://roller.apache.org/security.html>. |