Denodo Sharing Security Guide

The Denodo Community Team provides help and advice to Denodo Sharing projects on security issues and coordinates the handling of security vulnerabilities.

We strongly encourage you to report potential security vulnerabilities to our private channel first (https://www.denodo.com/en/contact-us), before disclosing them in a public forum.

Only use that contact to report undisclosed security vulnerabilities in Denodo Sharing projects and manage the process of fixing such vulnerabilities. We cannot accept regular bug reports or other security-related queries at this address. We will ignore reported items that do not relate to an undisclosed security problem in a Denodo Sharing project.

Please send one plain-text email for each vulnerability you are reporting. You do not need to encrypt submissions.

You can usually find information on known vulnerabilities for a Denodo Sharing project on the project's GitHub repository. If you can't find the information you are looking for on the project's repository, or in Github Issues, ask your question on the Denodo Community Q&A section.

An overview of the vulnerability handling process is:

• The reporter reports the vulnerability privately to the Denodo Community team.
• The appropriate Denodo Sharing project's security team works privately with the reporter to resolve the vulnerability.
• The project creates a new release of the package the vulnerability affects to deliver its fix.
• The project publicly announces the vulnerability and describes how to apply the fix.

This Security Guide is adapted from the ASF SecurityTeam vulnerability handling and others.