This repository documents the OpenSearch project's security vulnerability response process. It is the central reference for how security issues are reported, triaged, fixed, and disclosed across all opensearch-project repositories.
To report a vulnerability, email security@opensearch.org or use the Security tab on any opensearch-project repository to file a private vulnerability report.
| Document | Description |
|---|---|
| Security Release Process | End-to-end lifecycle from report intake through patch release and public disclosure |
| Intake Process | How to request a Draft GHSA or CVE for any OpenSearch repository |
| Private Fix Guidelines | Working with Draft GHSAs, temporary private forks, and commit message hygiene |
| Embargo Policy | Embargo terms, timelines, and pre-disclosure list |
| Roles and Responsibilities | SRT and Security TAG charter, membership, and how they interact |
| Vulnerability Classes | Shared vocabulary for what kind of issue a report describes, and the dispositions assessment can reach |
| Comms Templates | Email, Slack, and forum templates for each stage of the process |
The SRT is the operational arm — it handles triage, fix coordination, and disclosure. See ROLES.md for full responsibilities and membership criteria.
| Name | GitHub | Affiliation |
|---|---|---|
| Kunal Khatua | @kkhatua | Amazon |
| Craig Perkins | @cwperks | Amazon |
| Shikhar Jain | @shikharj05 | Amazon |
| Gulshan Kumar | @kumargu | Amazon |
| Nils Bandener | @nibix | Eliatra |
| Nagaraj G | @nagarajg17 | Amazon |
The Security TAG is the advisory arm — it advises on severity, out-of-band release decisions, and policy changes, and makes recommendations to the TSC. See ROLES.md for full responsibilities and how the two groups work together.
| Channel | Visibility | Use |
|---|---|---|
| security@opensearch.org | Private | Report vulnerabilities. Monitored and triaged by the SRT. |
| GitHub Security tab | Private | File a private vulnerability report on any opensearch-project repo. |
| OpenSearch Forum — Security | Public | General security discussion. |
This project has adopted the Contributor Covenant as its Code of Conduct. All community members are expected to adhere to it. See CODE_OF_CONDUCT.md for details. This project is part of the Linux Foundation.
This project is licensed under the Apache License 2.0.