mirror of https://github.com/grafana/grafana.git
30 lines
2.2 KiB
Markdown
30 lines
2.2 KiB
Markdown
# Reporting security issues
|
||
|
||
If you think you have found a security vulnerability, we have two routes for reporting security issues.
|
||
|
||
Important: Whichever route you choose, we ask you to not disclose the vulnerability before it has been fixed and announced, unless you received a response from the Grafana Labs security team that you can do so.
|
||
|
||
[Full guidance on reporting a security issue can be found here](https://grafana.com/legal/report-a-security-issue/).
|
||
|
||
This product is in scope for our Bug Bounty Program. To submit a vulnerability report, please visit [Grafana Labs Bug Bounty page](https://app.intigriti.com/programs/grafanalabs/grafanaossbbp/detail) and follow the instructions provided. Our security team will review your submission and get back to you as soon as possible.
|
||
|
||
---
|
||
|
||
For products and services outside the scope of our bug bounty program, or if you do not wish to receive a bounty, you can report issues directly to us via email at security@grafana.com. This address can be used for all of Grafana Labs’ open source and commercial products (including but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com).
|
||
|
||
Please encrypt your message to us; please use our PGP key. The key fingerprint is:
|
||
|
||
225E 6A9B BB15 A37E 95EB 6312 C66A 51CC B44C 27E0
|
||
|
||
The key is available from [keyserver.ubuntu.com](https://keyserver.ubuntu.com/pks/lookup?search=0x225E6A9BBB15A37E95EB6312C66A51CCB44C27E0&fingerprint=on&op=index).
|
||
|
||
Grafana Labs will send you a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.
|
||
|
||
**Important:** We ask you to not disclose the vulnerability before it have been fixed and announced, unless you received a response from the Grafana Labs security team that you can do so.
|
||
|
||
## Security announcements
|
||
|
||
We will post a summary, remediation, and mitigation details for any patch containing security fixes on the Grafana blog. The security announcement blog posts will be tagged with the [security tag](https://grafana.com/tags/security/).
|
||
|
||
You can also track security announcements via the [RSS feed](https://grafana.com/tags/security/index.xml).
|