<!--

    Copyright (c) 2011-present Sonatype, Inc. All rights reserved.
    Includes the third-party code listed at http://links.sonatype.com/products/clm/attributions.
    "Sonatype" is a trademark of Sonatype, Inc.

-->

# Reporting Security Vulnerabilities

## When to report

First check
[Important advisories of known security vulnerabilities in Sonatype products](https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories)
to see if this has been previously reported.

## How to report

Please email reports regarding security related issues you find to [mailto:security@sonatype.com](security@sonatype.com).

Use our public key below to keep your message safe.

## What to include

Please use a descriptive subject line in your email report.

Your name and/or affiliation.

A detailed technical description of the vulnerability, attack scenario and where
possible, how we can reproduce your findings.

Provide us with a secure way to respond.

## What to expect

Your email will be acknowledged within 1 - 2 business days, and you'll receive a
more detailed response to your email within 7 business days.

We ask that everyone please follow responsible disclosure practices and allow
time for us to release a fix prior to public release.

Once an issue is reported, Sonatype uses the following disclosure process:

When a report is received, we confirm the issue and determine its severity.

If third-party services or software require mitigation before publication, those
projects will be notified.

## Our public key

```console
-----BEGIN PUBLIC KEY BLOCK-----

dh0XISRG0NkiLEXeGkrs7Sn7BAAsTsaH/1zU6YbvoWlMlHYT6EarFQ== =sFGt
-----END PUBLIC KEY BLOCK-----
```
