# Security Policy

## Reporting a Vulnerability
If you think you have found a security vulnerability, please send a report to amundsen-security@lists.lfaidata.foundation. Please do not post security vulnerabilities on Slack.

We don't currently have a PGP key, unfortunately.

An Amundsen committer will send you a response indicating the next steps in handling your report. After the initial reply to your report, the committer will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

*Important:* Please don't disclose the vulnerability before it have been fixed and announced, to protect our users.

## Security announcements

Please subscribe to [the announcements mailing list](https://lists.lfai.foundation/g/amundsen-announce), where we post notifications and remediation details for security vulnerabilities.
