Project Security Contacts

Last updated: 2026-09-11

This page lists the security policy and vulnerability reporting channel for each active CNCF project. The reporting channel is taken from each project's own security policy (SECURITY.md), discovered through the project's .project repository metadata. It supports the CNCF's obligations as an open source steward under the EU Cyber Resilience Act (CRA).

Of the 220 active projects with a .project repository: 172 publish a security policy and 215 provide a vulnerability reporting channel.

Report a vulnerability

To report a vulnerability in a CNCF project, use the project's vulnerability reporting link below. If a project has no reporting channel listed, contact projects@cncf.io with a subject line starting with [SECURITY].

Entries marked ⚠️ Missing indicate the project has not yet published the relevant security metadata. Maintainers can fix this by adding a SECURITY.md to their project and referencing it from project.yaml in their .project repository — see the schema documentation.

Graduated

Project	Security policy	Report a vulnerability
Argo	Security policy	GitHub Security Advisory
Buildpacks	Security policy	GitHub Security Advisory
cert-manager	Security policy	cert-manager-security@googlegroups.com
Cilium	Security policy	security@cilium.io
CloudEvents	Security policy	cncf-cloudevents-security@lists.cncf.io
containerd	Security policy	containerd-security-announce@lists.cncf.io
CoreDNS	Security policy	GitHub Security Advisory
CRI-O	Security policy	cncf-crio-security@lists.cncf.io
Crossplane	Security policy	crossplane-security@lists.cncf.io
CubeFS	Security policy	security@cubefs.groups.io
Dapr	Security policy	GitHub Security Advisory
Dragonfly	Security policy	dragonfly-maintainers@googlegroups.com
Envoy	Security policy	GitHub Security Advisory
Falco	Security policy	cncf-falco-maintainers@lists.cncf.io
Fluentd	Security policy	GitHub Security Advisory
Flux	Security policy	cncf-flux-security@lists.cncf.io
Harbor	Security policy	GitHub Security Advisory
Helm	Security policy	cncf-helm-security@lists.cncf.io
in-toto	Security policy	GitHub Security Advisory
Istio	Security policy	GitHub Security Advisory
Jaeger	Security policy	GitHub Security Advisory
KEDA	Security policy	cncf-keda-maintainers@lists.cncf.io
KubeEdge	Security policy	cncf-kubeedge-security@lists.cncf.io
Kubeflow	⚠️ Missing	GitHub Security Advisory
Kyverno	Security policy	kyverno-security@googlegroups.com
Open Policy Agent (OPA)	Security policy	GitHub Security Advisory
OpenTelemetry	Security policy	GitHub Security Advisory
Rook	Security policy	cncf-rook-security@lists.cncf.io
SPIFFE	Security policy	security@spiffe.io
The Update Framework (TUF)	⚠️ Missing	GitHub Security Advisory
TiKV	Security policy	tikv-security@lists.cncf.io
Vitess	Security policy	cncf-vitess-maintainers@lists.cncf.io

Incubating

Project	Security policy	Report a vulnerability
Artifact Hub	Security policy	cncf-artifacthub-maintainers@lists.cncf.io
Backstage	Security policy	GitHub Security Advisory
Chaos Mesh	Security policy	chaos-mesh-security@lists.cncf.io
Cloud Custodian	Security policy	security@cloudcustodian.io
Contour	Security policy	GitHub Security Advisory
Cortex	Security policy	cortex-team@googlegroups.com
Emissary-Ingress	⚠️ Missing	GitHub Security Advisory
Flatcar Container Linux	Security policy	security@flatcar-linux.org
Fluid	Security policy	fluid.opensource.project@gmail.com
gRPC	Security policy	grpc-security@googlegroups.com
Karmada	Security policy	cncf-karmada-security@lists.cncf.io
Keycloak	Security policy	keycloak-security@googlegroups.com
KServe	Security policy	GitHub Security Advisory
Kubescape	Security policy	GitHub Security Advisory
KubeVela	Security policy	security@mail.kubevela.io
KubeVirt	Security policy	cncf-kubevirt-security@lists.cncf.io
Lima	Security policy	GitHub Security Advisory
Litmus	Security policy	litmuschaos@gmail.com
Longhorn	Security policy	GitHub Security Advisory
Metal3	Security policy	GitHub Security Advisory
Microcks	Security policy	security@microcks.io
NATS	⚠️ Missing	GitHub Security Advisory
Notary Project	Security policy	GitHub Security Advisory
OpenCost	Security policy	GitHub Security Advisory
OpenFeature	Security policy	cncf-openfeature-maintainers@lists.cncf.io
OpenFGA	Security policy	security@openfga.dev
OpenKruise	Security policy	kubernetes-security@service.aliyun.com
OpenYurt	Security policy	security@mail.openyurt.io
Operator Framework	Security policy	GitHub Security Advisory
Strimzi	Security policy	cncf-strimzi-maintainers@lists.cncf.io
Tekton	Security policy	GitHub Security Advisory
Thanos	Security policy	thanos-io@googlegroups.com
Volcano	Security policy	volcano-sig-security@googlegroups.com
wasmCloud	Security policy	security@wasmcloud.com

Sandbox

Project	Security policy	Report a vulnerability
Aeraki Mesh	Security policy	zhaohuabing@gmail.com
Agones	Security policy	GitHub Security Advisory
Akri	Security policy	cncf-akri-security@lists.cncf.io
Antrea	Security policy	cncf-antrea-maintainers@lists.cncf.io
Apicurio Registry	Security policy	GitHub Security Advisory
Armada	Security policy	GitHub Security Advisory
Athenz	⚠️ Missing	GitHub Security Advisory
Atlantis	Security policy	GitHub Security Advisory
Bank-Vaults	Security policy	team@bank-vaults.dev
BFE	Security policy	bfe-security@baidu.com
bootc	Security policy	GitHub Security Advisory
bpfman	Security policy	GitHub Security Advisory
Cadence Workflow	Security policy	GitHub Security Advisory
Capsule	Security policy	GitHub Security Advisory
Carina	⚠️ Missing	GitHub Security Advisory
Cartography	Security policy	cncf-cartography-maintainers@lists.cncf.io
Carvel	⚠️ Missing	GitHub Security Advisory
CDK for Kubernetes (CDK8s)	Security policy	cncf-cdk8s-security@lists.cncf.io
Chaosblade	⚠️ Missing	GitHub Security Advisory
CloudNativePG	Security policy	GitHub Security Advisory
Clusternet	⚠️ Missing	GitHub Security Advisory
Clusterpedia	⚠️ Missing	GitHub Security Advisory
CoHDI	⚠️ Missing	GitHub Security Advisory
Confidential Containers	Security policy	GitHub Security Advisory
Connect RPC	Security policy	⚠️ Missing
container2wasm	⚠️ Missing	GitHub Security Advisory
ContainerSSH	Security policy	GitHub Security Advisory
Copa	Security policy	GitHub Security Advisory
Cozystack	Security policy	GitHub Security Advisory
Curvine	Security policy	curvine86@gmail.com
Dalec	Security policy	GitHub Security Advisory
Devfile	Security policy	team-devfile-security@redhat.com
DevSpace	Security policy	security@loft.sh
Dex	Security policy	cncf-dex-maintainers@lists.cncf.io
Distribution	Security policy	cncf-distribution-security@lists.cncf.io
Drasi	Security policy	security@drasi.io
Easegress	Security policy	GitHub Security Advisory
Eraser	⚠️ Missing	GitHub Security Advisory
external-secrets	Security policy	cncf-ExternalSecretsOp-maintainers@lists.cncf.io
hami	Security policy	GitHub Security Advisory
Headlamp	Security policy	GitHub Security Advisory
Higress	Security policy	GitHub Security Advisory
HolmesGPT	Security policy	GitHub Security Advisory
HwameiStor	⚠️ Missing	GitHub Security Advisory
Hyperlight	Security policy	GitHub Security Advisory
Inclavare Containers	Security policy	security@inclavare-containers.io
Inspektor Gadget	⚠️ Missing	GitHub Security Advisory
Interlink	⚠️ Missing	GitHub Security Advisory
k0s	Security policy	cncf-k0s-maintainers@lists.cncf.io
k3s	Security policy	security@k3s.io
k8gb	Security policy	cncf-k8gb-maintainers@lists.cncf.io
K8sGPT	Security policy	contact@k8sgpt.ai
K8up	⚠️ Missing	GitHub Security Advisory
kagent	Security policy	kagent-vulnerability-reports@googlegroups.com
KAI Scheduler	Security policy	GitHub Security Advisory
Kairos	Security policy	GitHub Security Advisory
KAITO	Security policy	secure@microsoft.com
Kanister	Security policy	GitHub Security Advisory
kbind	Security policy	GitHub Security Advisory
KCL	⚠️ Missing	GitHub Security Advisory
kcp	Security policy	GitHub Security Advisory
Kepler	Security policy	GitHub Security Advisory
Keylime	⚠️ Missing	GitHub Security Advisory
Kgateway	Security policy	kgateway-vulnerability-reports@googlegroups.com
KitOps	Security policy	GitHub Security Advisory
Kmesh	Security policy	kmesh-security-vulnerability@googlegroups.com
ko	⚠️ Missing	GitHub Security Advisory
Konveyor	Security policy	konveyor-security@googlegroups.com
Koordinator	Security policy	kubernetes-security@service.aliyun.com
kpt	⚠️ Missing	⚠️ Missing
Krkn	Security policy	cncf-krkn-maintainers@lists.cncf.io
Kuadrant	Security policy	GitHub Security Advisory
Kuasar	⚠️ Missing	GitHub Security Advisory
Kube-burner	Security policy	GitHub Security Advisory
Kube-OVN	Security policy	cncf-Kube-OVN-maintainers@lists.cncf.io
kube-rs	Security policy	GitHub Security Advisory
kube-vip	⚠️ Missing	GitHub Security Advisory
Kubean	⚠️ Missing	GitHub Security Advisory
KubeArmor	Security policy	GitHub Security Advisory
KubeClipper	⚠️ Missing	GitHub Security Advisory
KubeElasti	Security policy	GitHub Security Advisory
KubeFleet	Security policy	-distributors-announce@lists.cncf.io
Kuberhealthy	⚠️ Missing	GitHub Security Advisory
KubeSlice	Security policy	security@kubeslice.io
KubeStellar	Security policy	kubestellar-security-announce@googlegroups.com
Kubewarden	Security policy	GitHub Security Advisory
KUDO	⚠️ Missing	GitHub Security Advisory
Kuma	Security policy	GitHub Security Advisory
Kured	Security policy	cncf-kured-maintainers@lists.cncf.io
KusionStack	Security policy	kusionstack@gmail.com
llm-d	Security policy	llm-d-security-reporting@googlegroups.com
Logging Operator (Kube Logging)	Security policy	team@kube-logging.dev
LoxiLB	Security policy	loxilb-devel@netlox.io
Meshery	Security policy	GitHub Security Advisory
MetalLB	⚠️ Missing	GitHub Security Advisory
ModelPack	Security policy	GitHub Security Advisory
Network Service Mesh	⚠️ Missing	GitHub Security Advisory
NMstate	Security policy	GitHub Security Advisory
OAuth2 Proxy	Security policy	GitHub Security Advisory
Open Cluster Management	Security policy	OCM-security@googlegroups.com
Open Policy Containers	⚠️ Missing	GitHub Security Advisory
Open Workflow Specification	Security policy	GitHub Security Advisory
OpenChoreo	Security policy	GitHub Security Advisory
OpenEBS	Security policy	GitHub Security Advisory
OpenEverest	Security policy	GitHub Security Advisory
OpenFunction	⚠️ Missing	GitHub Security Advisory
openGemini	⚠️ Missing	GitHub Security Advisory
OpenGitOps	Security policy	cncf-opengitops-maintainers@lists.cncf.io
OpenTofu	Security policy	GitHub Security Advisory
ORAS	Security policy	GitHub Security Advisory
OSCAL-COMPASS	Security policy	oscal-compass-oversight@googlegroups.com
OVN-Kubernetes	Security policy	GitHub Security Advisory
Oxia	⚠️ Missing	GitHub Security Advisory
Paralus	⚠️ Missing	GitHub Security Advisory
Parsec	Security policy	GitHub Security Advisory
Perses	Security policy	perses-team@googlegroups.com
PipeCD	Security policy	khanhtc1202@gmail.com
Piraeus Datastore	Security policy	GitHub Security Advisory
Pixie	Security policy	cncf-pixie-maintainers@lists.cncf.io
Podman Container Tools	Security policy	security@lists.podman.io
Podman Desktop	Security policy	cncf-podman-desktop-security@lists.cncf.io
Porter	Security policy	GitHub Security Advisory
Radius	Security policy	security@radapp.dev
Ratify	Security policy	GitHub Security Advisory
Runme Notebooks	⚠️ Missing	GitHub Security Advisory
SchemaHero	⚠️ Missing	GitHub Security Advisory
Score	Security policy	GitHub Security Advisory
Sermant	⚠️ Missing	GitHub Security Advisory
Serverless Devs	⚠️ Missing	GitHub Security Advisory
Shipwright	Security policy	shipwright-security@lists.cncf.io
SlimFaaS	Security policy	guillaume.chervet@axa.fr
SlimToolkit	Security policy	GitHub Security Advisory
SOPS	⚠️ Missing	GitHub Security Advisory
Spiderpool	⚠️ Missing	GitHub Security Advisory
SpinKube	Security policy	GitHub Security Advisory
Stacker	Security policy	GitHub Security Advisory
Submariner	⚠️ Missing	GitHub Security Advisory
Telepresence	Security policy	secalert@tada.se
Tinkerbell	⚠️ Missing	GitHub Security Advisory
Tokenetes	⚠️ Missing	GitHub Security Advisory
Tremor	Security policy	opensource@wayfair.com
Trickster	Security policy	GitHub Security Advisory
urunc	Security policy	GitHub Security Advisory
Velero	Security policy	cncf-velero-security@lists.cncf.io
Virtual Kubelet	⚠️ Missing	GitHub Security Advisory
Visual Studio Code Kubernetes Tools	Security policy	GitHub Security Advisory
WasmEdge Runtime	Security policy	WasmEdge@googlegroups.com
werf	Security policy	cncf-werf-security@lists.cncf.io
xRegistry	⚠️ Missing	GitHub Security Advisory
youki	Security policy	GitHub Security Advisory
zot	Security policy	GitHub Security Advisory

Unknown maturity

Project	Security policy	Report a vulnerability
cedar-policy	⚠️ Missing	⚠️ Missing
composefs	⚠️ Missing	⚠️ Missing
sdcio	⚠️ Missing	⚠️ Missing