# Security Policy for Argo Rollouts


## Reporting a Vulnerability

If you find a security related bug in Argo Rollouts, we kindly ask you for responsible
disclosure and for giving us appropriate time to react, analyze and develop a
fix to mitigate the found security vulnerability.

Please report vulnerabilities by e-mail to the following address: 

* cncf-argo-security@lists.cncf.io

All vulnerabilites and associated information will be treated with full confidentiality. 

## Public Disclosure

We will publish security advisiories using the
[GitHub Security Advisories](https://github.com/argoproj/argo-rollouts/security/advisories)
feature to keep our community well informed, and will credit you for your
findings (unless you prefer to stay anonymous, of course).

## Internet Bug Bounty collaboration

We're happy to announce that the Argo project is collaborating with the great
folks over at
[Hacker One](https://hackerone.com/) and their
[Internet Bug Bounty program](https://hackerone.com/ibb)
to reward the awesome people who find security vulnerabilities in the four
main Argo projects (CD, Events, Rollouts and Workflows) and then work with
us to fix and disclose them in a responsible manner.

If you report a vulnerability to us as outlined in this security policy, we
will work together with you to find out whether your finding is eligible for
claiming a bounty, and also on how to claim it.

