# Knative security policy

To report a security issue, please email security@knative.team with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue. Our vulnerability management team will respond within 3 working days of your email. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.

Please see [Early Disclosure of Security Vulnerabilities](https://github.com/knative/community/blob/main/working-groups/security/disclosure.md) and [Vulnerability Disclosure Response Policy](https://github.com/knative/community/blob/main/working-groups/security/responding.md) as well.

Knative Open Source Security Foundation (OpenSSF) best practices badge [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5913/badge)](https://bestpractices.coreinfrastructure.org/projects/5913)
