Skip to content

SECURITY.md

Latest commit

 

History

History
39 lines (31 loc) · 1.46 KB

SECURITY.md

File metadata and controls

39 lines (31 loc) · 1.46 KB
Raw

Security Policy

Apache APISIX (including this ingress controller) follows the Apache Software Foundation's vulnerability-disclosure policy. Please report security vulnerabilities to the ASF Security team at security@apache.org per https://www.apache.org/security/.

Threat Model

This repository inherits the Apache APISIX project threat model at:

https://github.com/apache/apisix/blob/master/docs/en/latest/security-threat-model.md

Of particular relevance to apisix-ingress-controller: §4.8 covers a CRD-to-Admin-API fidelity invariant specific to this controller (silent drop / injection / rename between the apisix.apache.org CRD spec and the Admin API target is a controller bug).