---
title: Security and audits
---

The containerd project has a significant focus on the security of the container runtime layer on which so many
other software systems depend. We have a clear and well-documented security process and use GitHub security
features and their CVE numbering authority to properly disclose any identified and verified vulnerabilities.

### Reporting security issues

Please follow the project's reporting process outlined in [SECURITY.md](https://github.com/containerd/project/blob/main/SECURITY.md) within the `containerd/project` GitHub repository.

### Security audits

Security audits are performed from time to time for the project, enabled by investment from the CNCF or other
interested parties. When public reports are published as a result of these audits we will publish them
in the following table.

| Name/Link | Description | Date |
|---------------------------------------|-------------------------------------------------------------------|--------|
| Fuzzing audit - [ADA-fuzzing-audit-21-22.pdf](/img/ADA-fuzzing-audit-21-22.pdf) | Fuzzing audit funded by the CNCF, audit by Ada Logics | March 2023 |
| CNCF Graduated Project audit - [SECURITY_AUDIT.pdf](/img/SECURITY_AUDIT.pdf) | Security audit funded by the CNCF, audit by Cure53 | Nov 2018 |
