CRA stewardship: This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project's emergency security reporting mechanisms as appropriate.

For details on all Community supported versions of CloudNativePG, please refer to the "Supported releases" section in the official documentation.

Please do not report vulnerabilities through public issues, discussions, pull requests or Slack. Use GitHub's private vulnerability reporting form and include the affected version(s), a description of the impact, and steps to reproduce.

These are targets for a volunteer-maintained project. We will tell the reporter if we expect to miss one.

• Acknowledgement: within 10 business days of the report.
• Initial assessment: within 4 weeks, confirming whether it is a vulnerability and its severity.
• Closure: within 6 months, with a fix released for all supported versions and a GitHub security advisory published (with a CVE where appropriate).

Details stay private until a fix is available, and the disclosure date is coordinated with the reporter, who is credited unless they prefer otherwise.

Past advisories are listed on the security advisories page.