# Security

The kcp maintainers take security for kcp very seriously, especially given kcp's sensitive nature as an API control plane.

## Reporting a Vulnerability

kcp uses GitHub to allow submission of private security reports. Please report any security finding via [this link](https://github.com/kcp-dev/kcp/security/advisories/new) or send a direct email to [kcp-dev-private@googlegroups.com](mailto:kcp-dev-private@googlegroups.com). Maintainers will triage your report as soon as possible and get in touch with you via your report or via email in case they have more questions.

As a security researcher, please report vulnerabilities to kcp in a [coordinated vulnerability disclosure](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html) fashion. In return, maintainers pledge to engage in good faith and collaborate with security researchers to address and publish vulnerabilities found in kcp as soon as possible.

Please understand that the maintainers also do not accept results of dependency scanners without proof that the detected CVE / vulnerability can be used against kcp.

## Security Advisories

Advisories are managed through GitHub. Public disclosure of vulnerabilities happens through GitHub and the kcp-users mailing list. Please visit [Security Advisories](https://github.com/kcp-dev/kcp/security/advisories) to review security bulletins published by the maintainers.
