Skip to content

chore(security.md): add more precisions regarding sec bugs reporting #2692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(security.md): add more precisions regarding sec bugs reporting #2692

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d0728b8
chore(security.md): add more precisions regarding sec bugs reporting
machine424 Jul 15, 2025
ff6aee6
address review feedback
machine424 Jul 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions docs/operating/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,22 @@ This page describes the general security assumptions of Prometheus and the
attack vectors that some configurations may enable.

As with any complex system, it is near certain that bugs will be found, some of
them security-relevant. If you find a _security bug_ please report it
privately to the maintainers listed in the MAINTAINERS of the relevant
them security-relevant.

For _security bugs_ that have already been publicly disclosed (e.g. via public CVEs)
and require more than just a dependency version bump to fix, please open a
[Bug report](https://github.com/prometheus/prometheus/issues) including all relevant
details, unless one has already been filed.

If you discover a _security bug_ that has not yet been publicly disclosed, please
report it privately to the maintainers listed in the MAINTAINERS of the relevant
repository and CC [email protected]. We will fix the issue as soon
as possible and coordinate a release date with you. You will be able to choose
if you want public acknowledgement of your effort and if you want to be
mentioned by name.
as possible and coordinate a release date with you. You will be able to choose if
you want public acknowledgement of your effort and if you want to be mentioned by name.

Most dependency version updates are handled automatically. However, if a _security bug_
fix only requires updating a dependency version and our automation missed it, feel
free to submit the update directly.

## Automated security scanners

Expand Down