Please do not report security vulnerabilities or security incidents via public channels (such as GitHub Issues or Pull Requests).
To ensure coordinated disclosure, please email the Konflux security team at konflux-sec[at]googlegroups.com with a description of the issue, how to reproduce it and any mitigations you are aware of.
If possible please include a proposed severity rating (for example, see Red Hat's severity ratings), and other classifying metadata such as a CWE ID or a CVSS score.
Our security team will respond within three working days of your email.
To help us triage and resolve the issue efficiently, please include the following in your report:
- Title: A concise, descriptive summary of the issue.
- Reporter Details: Your name/handle and affiliation.
- Technical Description: Detailed information regarding the vulnerability.
- Affected Versions: The specific version(s) or range(s) of software tested.
- Reproduction Steps: A minimal, functional example to reproduce the issue.
- Impact Assessment: Potential exploit scenarios and perceived severity. (optional)
- Suggested Fix: Any proposed patches or mitigations (optional).
- Disclosure Status: Whether this has been shared with other parties or published and your plan for future sharing (e.g., at a conference).
Direct all security questions and vulnerability reports to:
- Email: konflux-sec[at]googlegroups.com
Full details of Red Hat’s security disclosure and remediation process can be found here: https://access.redhat.com/articles/red-hat-coordinated-vulnerability-disclosure
This project is stewarded by Red Hat, Inc., an open source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847). Contact: cra-steward@redhat.com
Refer to Red Hat's security practices and vulnerability management policy for detailed information.