We know that security is very important to the Spinnaker community. We welcome (and encourage) any reviews and testing of Spinnaker’s open source code to ensure the quality and security of Spinnaker for users around the world.

If you would like to report a vulnerability in the Spinnaker open source code, please email us at security@spinnaker.io right away and a member of the Security SIG will get back to you as soon as we are able. We deeply appreciate your support in discovering and disclosing security issues in a responsible way.

Please share any information we need to understand and reproduce the security issue you’ve discovered, including:

• A complete description of the security issue
• Steps to detect or reproduce the security bug
• Versions and configurations affected by the issue
• Whether you would like credit for finding the bug

Note: As an open source community, we do not provide bug bounties for security reports at this time.

To help us prioritize bugs affecting the Spinnaker community, please only report security issues affecting the Spinnaker open source code or common configurations for deployed Spinnaker services. Please keep in mind that security issues with higher severity will receive priority over less impactful bugs.

Note: Do not conduct testing or security research against systems or data that you do not own.

Absolutely! We love code contributions too, especially for security improvements. Please follow the contributing guidelines for any changes you would like to share. If you have any questions, feel free to contact the Security SIG by saying hello in the Spinnaker Slack #security-sig channel.

The spinnaker community does not offer remuneration for reporting of vulnerabilities. We acknowledge the reporter on the CVEs upon request as a public thank you for their contribution.

We’ve created a 4-step process to review and mitigate any reported security issues in Spinnaker open source code. These steps are further described in the Vulnerability Handling Process document.

As part of the Spinnaker community, members of the Security SIG have volunteered to review and triage security vulnerabilities detected in Spinnaker open source code. All security issues that have been responsibly disclosed to security@spinnaker.io will be acknowledged and reviewed within one week of receiving the report.

New security vulnerabilities will be assessed against our predefined security taxonomy which is explained in detail in our Vulnerability Handling Process. We will work with you (the security researcher) to determine the scope and impact of the security issue, assign a severity rating, and reserve a CVE ID for newly discovered bugs.

We track and monitor security vulnerabilities in Spinnaker open source code through non-public mechanisms available to all members of the Security SIG, and will review new security reports during the Security SIG bi-weekly meeting (or more frequently, as needed).

Once a security issue has been confirmed and evaluated, the Security SIG will work with other members of the Spinnaker community to identify individuals to develop a patch or fix for each bug. Code changes for security issues will be developed publicly unless otherwise accepted by majority vote of the Security SIG. We will then track released security patches in the changelog for each release and update the CVE record.

For general questions about Spinnaker security, feel free to join us in the Spinnaker Slack #security-sig channel. Questions or feedback regarding a security issue or vulnerability should be sent directly to security@spinnaker.io.

We’re thrilled that you’re interested in supporting Spinnaker security! The Security SIG, or Special Interest Group meets bi-weekly to address security issues and provide input on security capabilities within the Spinnaker project. You can get started by requesting an invite to the Spinnaker Slack team and joining the #security-sig channel.