Subversion Security

If you discover a security vulnerability in Subversion, please email:

security@subversion.tigris.org

It is safe to send sensitive reports to this address. List membership is controlled, and the archives are not publicly accessible. We will analyze your report and take appropriate action. Our usual procedure is to

1. Make a fix for the vulnerability.
2. Discreetly distribute the fix to a few large sites that run Subversion servers and are trusted to be discreet themselves.
3. Release a new version of Subversion (containing just that fix) and publicly announce the vulnerability on the same day.

This procedure may vary depending on the nature of the vulnerability and the degree of pre-existing public awareness, of course.

Please do not reproduce the above email address on other web pages or in public postings. Due to the need for responsiveness, the security list is unmoderated, which makes it particularly vulnerably to spammers. Furthermore, we cannot easily change its address, even if the list were to start receiving spam, because it's too important to have a consistent, dependable place to report security holes.

On this page, the address has been encoded in various ways to reduce the likelihood of a spam harvester noticing it. But if the address starts appearing in other places on the Internet, then the harvesters will inevitably pick it up, and we'll be stuck wading through ever-increasing amounts of spam, trying not to lose important vulnerability reports in the noise.