ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-13 03:42:35 -06:00
Code Issues Packages Projects Releases Wiki Activity

Security policy update (#8479)

Browse Source 
Since we have seen a few reports that assume no authn/authz lately,
let's update the policy to say something about that.

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This commit is contained in:
Anders Eknert
2026-04-02 14:12:24 +02:00
committed by GitHub
parent daf53373ec
commit 48fdef5f69
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/src/pages/security.mdx
+4
View File
@@ -7,6 +7,10 @@ response policy to ensure we responsibly handle critical issues.
## Reporting a Security Bug
- Before reporting a suspected security issue, make sure to read the documentation on OPA's
[security](https://www.openpolicyagent.org/docs/security) model. Attack vectors that depend on the OPA server running
without authentication/authorization enabled will not be considered, as none of OPAs APIs are protected at that point.
- If you think you have found a security issue in an OPA project, please send an email to
[open-policy-agent-security@googlegroups.com](mailto:open-policy-agent-security@googlegroups.com).
This list is delivered to a small security team. We will then acknowledge receipt of your report and prioritize initial analysis of severity.