From 48fdef5f69c2139c70e59e9cd565fd04d4aeb10c Mon Sep 17 00:00:00 2001 From: Anders Eknert Date: Thu, 2 Apr 2026 14:12:24 +0200 Subject: [PATCH] Security policy update (#8479) Since we have seen a few reports that assume no authn/authz lately, let's update the policy to say something about that. Signed-off-by: Anders Eknert --- docs/src/pages/security.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/src/pages/security.mdx b/docs/src/pages/security.mdx index 2dbdf75bc0..54abae923e 100644 --- a/docs/src/pages/security.mdx +++ b/docs/src/pages/security.mdx @@ -7,6 +7,10 @@ response policy to ensure we responsibly handle critical issues. ## Reporting a Security Bug +- Before reporting a suspected security issue, make sure to read the documentation on OPA's + [security](https://www.openpolicyagent.org/docs/security) model. Attack vectors that depend on the OPA server running + without authentication/authorization enabled will not be considered, as none of OPAs APIs are protected at that point. + - If you think you have found a security issue in an OPA project, please send an email to [open-policy-agent-security@googlegroups.com](mailto:open-policy-agent-security@googlegroups.com). This list is delivered to a small security team. We will then acknowledge receipt of your report and prioritize initial analysis of severity.