Title: ASF Security Team
Notice:    Licensed to the Apache Software Foundation (ASF) under one
           or more contributor license agreements.  See the NOTICE file
           distributed with this work for additional information
           regarding copyright ownership.  The ASF licenses this file
           to you under the Apache License, Version 2.0 (the
           "License"); you may not use this file except in compliance
           with the License.  You may obtain a copy of the License at
           .
             http://www.apache.org/licenses/LICENSE-2.0
           .
           Unless required by applicable law or agreed to in writing,
           software distributed under the License is distributed on an
           "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
           KIND, either express or implied.  See the License for the
           specific language governing permissions and limitations
           under the License.

# The Apache Security Team #

The Apache Security Team exists to provide help and advice to Apache
projects on security issues and to provide co-ordination of the handling of
security vulnerabilities. All members of the Security Team are also
[members](../foundation/members.html) of the Apache Software Foundation.

# Reporting a vulnerability #

We strongly encourage folks to report security vulnerabilities to one of
our private security mailing lists first, before disclosing them in a
public forum.

A [list of security contacts for Apache projects](projects.html) is
available. If you can't find a project specific security e-mail address and
you have an undisclosed security vulnerability to report then please use
the general security address below.

**Please note that the security mailing lists should only be used for
reporting undisclosed security vulnerabilities in Apache products and
managing the process of fixing such vulnerabilities. We cannot accept
regular bug reports or other security related queries at these addresses.
All mail sent to these addresses that does not relate to an undisclosed
security problem in an Apache product will be ignored.** 

**Also note that the security team handles vulnerabilities in Apache products,
not running ASF services.  All reports of vulnerabilities in running ASF
services should be sent to root@apache.org only.**

The general security mailing list address is:
[security@apache.org](mailto:security@apache.org). This is a private
mailing list and only members of the Apache Security Team are subscribed.

Please note that we do not use a team OpenPGP key. If you wish to encrypt
your e-mail to security@apache.org then please use the OpenPGP keys of the
following subset of members of the Apache Security Team and be aware that
it may take us a little longer to respond to the issue. Note that this is
not a complete list of Apache Security Team members and that you should not
contact these members individually about security issues.

- Mark Cox - 7B 79 19 FA 71 6B 87 25 0E 77 21 E5 52 D9 83 BF -
[pgp.mit.edu](http://pgp.mit.edu:11371/pks/lookup?search=0x49A563D9&op=index) 

- Lars Eilebrecht - 7B 8A E3 E0 8C 63 04 57 77 72 39 E6 5A 7E 51 FC -
[pgp.mit.edu](http://pgp.mit.edu:11371/pks/lookup?search=0xF88341D9&op=index) 

- Ben Laurie - 7656 55DE 62E3 96FF 2587 EB6C 4F6D E156 2118 CF83 -
[pgp.mit.edu](http://pgp.mit.edu:11371/pks/lookup?search=0x2118CF83&op=index) 

- Bill Rowe - B1B9 6F45 DFBD CCF9 7401 9235 193F 180A B55D 9977 -
[pgp.mit.edu](http://pgp.mit.edu:11371/pks/lookup?search=0xB55D9977&op=index) 

- Mark Thomas - A9C5 DF4D 22E9 9998 D987 5A51 10C0 1C5A 2F60 59E7 -
[pgp.mit.edu](http://pgp.mit.edu:11371/pks/lookup?search=0x2F6059E7&op=index) 

The keys for all of the above can also be obtained in a single file from
[The Apache Software Foundation](KEYS.txt).

# Vulnerability Information #

Information on the published vulnerabilities for an Apache project can
usually be found on the project's web pages. For convenience a [list of
security information pages for Apache projects](projects.html) is
available. If you can't find the information you are looking for on the
project's web site, you should ask your question on the project's user
mailing list. The security lists **should not be used to ask questions
about** :

- how to configure the product securely;

- if a published vulnerability applies to the version of the Apache product
you are using;

- if a published vulnerability applies to the configuration of the Apache
product you are using;

- obtaining further information on a published vulnerability;

- the availability of patches and/or new releases to address a published
vulnerability.

The relevant project's users list is the place to ask such questions. Any
such questions sent to the Apache Security Team or to a project security
team will be ignored.

# Vulnerability handling #

An overview of the vulnerability handling process is:

- The reporter reports the vulnerability privately to Apache.

- The appropriate project's security team works privately with the reporter
to resolve the vulnerability.

- A new release of the Apache product concerned is made that includes the
fix.

- The vulnerability is publically announced.

A [more detailed description of the process](committers.html) has been
written for committers. Reporters of security vulnerabilities may also find
it useful.