Security Vulnerability Disclosure and Response Process

TiDB is a fast-growing open source database. To ensure its security, a security vulnerability disclosure and response process is adopted.

The primary goal of this process is to reduce the total exposure time of users to publicly known vulnerabilities. To quickly fix vulnerabilities of TiDB products, the security team is responsible for the entire vulnerability management process, including internal communication and external disclosure.

If you find a vulnerability or encounter a security incident involving vulnerabilities of TiDB products, please report it as soon as possible to the TiDB security team (security@tidb.io).

Please kindly help provide as much vulnerability information as possible in the following format:

• Issue title*:

• Overview*:

• Affected components and version number*:

• CVE number (if any):

• Vulnerability verification process*:

• Contact information*:

The asterisk (*) indicates the required field.

Response Time

The TiDB security team will confirm the vulnerabilities and contact you within 2 working days after your submission.

We will publicly thank you after fixing the security vulnerability. To avoid negative impact, please keep the vulnerability confidential until we fix it. We would appreciate it if you could obey the following code of conduct:

The vulnerability will not be disclosed until TiDB releases a patch for it.

The details of the vulnerability, for example, exploits code, will not be disclosed.