> ## Documentation Index
> Fetch the complete documentation index at: https://docs.datris.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Disclosure

> How to report a security issue in Datris, what to expect back, and how fixes and advisories reach you

## Reporting

Report suspected vulnerabilities **privately** through GitHub's security advisory process:

> [github.com/datris/datris-platform-oss/security/advisories/new](https://github.com/datris/datris-platform-oss/security/advisories/new)

Please do not open a public issue for a security report. If you cannot use GitHub, email `info@datris.ai` with the same detail you would put in an advisory: affected version, component, reproduction steps, and impact.

## Response targets

|                                   |                                                                                                                                     |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Acknowledgement                   | within 3 business days                                                                                                              |
| Remediation timeline communicated | within 10 business days                                                                                                             |
| Fix delivery                      | in the next release; security fixes go to the latest minor version only — see [Upgrades & Supported Versions](/production/upgrades) |

## Advisories

Fixed vulnerabilities are published as GitHub Security Advisories on the repository and summarized in the [changelog](/changelog) with impact described in general terms. Deployments that [register with Datris.ai](https://datris.ai/register) and commercial licensees receive advisories ahead of public disclosure.

## SBOM and scanning

* **SBOM.** Every release publishes a CycloneDX software bill of materials for each of the four container images (server, UI, MCP server, tap runner), generated by Syft and attached to the release's `docker-publish` workflow run on GitHub.
* **Dependency scanning.** Trivy runs on every pull request and push to `main` and fails the build on new HIGH or CRITICAL findings with an available fix. Published images are re-scanned weekly for OS-package CVEs. Dependabot security updates cover GitHub Actions, npm, pip, and Docker base images; JVM dependencies are covered through the GitHub dependency graph.
* **Secret scanning and push protection** are enabled on the repository.

## Related

* [Security Architecture](/production/security-architecture) — the model these controls sit in
* The repository's `SECURITY.md` is the canonical statement of this policy.