Security Policy

How to Report Potential Security Vulnerabilities

Please see the README of the spring-projects/security-advisories repository for guidelines on reporting a vulnerability. Any potential security vulnerabilities should be reported through the Security Advisories page.

The Spring team needs to receive reports of potential security vulnerabilities through GitHub’s ability to privately report a security vulnerability. To simplify the process, the spring-projects/security-advisories repository is used to report potential vulnerabilities for any project within the Spring portfolio (this includes projects in other GitHub organizations, such as Spring Cloud).

Viewing Security Vulnerabilities

All security vulnerabilities are posted to https://spring.io/security/.