This is an automated email from the ASF dual-hosted git repository.
jojochuang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone-site.git
The following commit(s) were added to refs/heads/master by this push:
new fccc409d10 HDDS-16157. Add security issue report process (#540)
fccc409d10 is described below
commit fccc409d10809b5ea9dd0d4622795ecce27a7439
Author: Mark Tsai <[email protected]>
AuthorDate: Wed Sep 2 13:29:25 2026 +0800
HDDS-16157. Add security issue report process (#540)
---
src/pages/community/communication-channels.md | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/pages/community/communication-channels.md
b/src/pages/community/communication-channels.md
index 3b0d3c98dc..28e832cd34 100644
--- a/src/pages/community/communication-channels.md
+++ b/src/pages/community/communication-channels.md
@@ -5,6 +5,7 @@ Apache Ozone offers several ways to connect with the community.
Whether you have
## Quick Links
- [Mailing Lists](#mailing-lists): Primary communication for development
discussions and decisions
+- [Reporting Security Vulnerabilities](#reporting-security-vulnerabilities):
Report undisclosed security vulnerabilities privately
- [GitHub Discussions](#github-discussions): Q&A and community discussions
- [Slack](#slack): Real-time chat with community members
- [Jira](#jira): Issue tracking and project management
@@ -39,6 +40,16 @@ For user questions and discussions:
- Respond inline to long emails with multiple points
- Follow the [Apache Code of
Conduct](https://www.apache.org/foundation/policies/conduct.html)
+## Reporting Security Vulnerabilities
+
+The Apache Ozone project maintains a security mailing list for anyone to
report security vulnerabilities in the project.
+
+- **Report vulnerabilities**:
[[email protected]](mailto:[email protected])
+- **Reporting guidelines**: [ASF Project Security for
Committers](https://www.apache.org/security/committers.html)
+- **Published security advisories**:
[security.apache.org/projects/ozone](https://security.apache.org/projects/ozone/)
+
+Note: Known vulnerabilities in thirdparty dependencies should not be reported
using this channel.
+
## GitHub Discussions
[GitHub Discussions](https://github.com/apache/ozone/discussions) is perfect
for Q&A, sharing ideas, and community conversations.
@@ -116,6 +127,7 @@ The Ozone community holds regular video calls to discuss
project progress, make
## Choosing the Right Channel
- **Mailing Lists**: For official discussions, design proposals, community
decisions
+- **Reporting Security Vulnerabilities**: For privately reporting undisclosed
security vulnerabilities in Ozone. Do not use Jira or GitHub for this.
- **GitHub Discussions**: For Q&A, ideas, and general conversations about Ozone
- **Slack**: For quick questions and real-time chat
- **Jira**: For tracking specific bugs, improvements, and feature requests
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
