Project Security Contacts

Last updated: 2026-08-21

This page lists the security policy and vulnerability reporting channel for each active CNCF project. The reporting channel is taken from each project's own security policy (SECURITY.md), discovered through the project's .project repository metadata. It supports the CNCF's obligations as an open source steward under the EU Cyber Resilience Act (CRA).

Of the 166 active projects with a .project repository: 124 publish a security policy and 162 provide a vulnerability reporting channel.

Report a vulnerability

To report a vulnerability in a CNCF project, use the project's vulnerability reporting link below. If a project has no reporting channel listed, contact security@cncf.io.

Entries marked ⚠️ Missing indicate the project has not yet published the relevant security metadata. Maintainers can fix this by adding a SECURITY.md to their project and referencing it from project.yaml in their .project repository — see the schema documentation.

Graduated

Project	Security policy	Report a vulnerability
cert-manager	Security policy	cert-manager-security@googlegroups.com
containerd	Security policy	containerd-security-announce@lists.cncf.io
Crossplane	Security policy	crossplane-security@lists.cncf.io
Dapr	Security policy	GitHub Security Advisory
Dragonfly	Security policy	dragonfly-maintainers@googlegroups.com
Kubeflow	⚠️ Missing	GitHub Security Advisory
Kyverno	Security policy	kyverno-security@googlegroups.com
OpenTelemetry	Security policy	GitHub Security Advisory

Incubating

Project	Security policy	Report a vulnerability
Fluid	Security policy	fluid.opensource.project@gmail.com
gRPC	Security policy	grpc-security@googlegroups.com
Karmada	Security policy	cncf-karmada-security@lists.cncf.io
KServe	Security policy	GitHub Security Advisory
Kubescape	Security policy	GitHub Security Advisory
KubeVirt	Security policy	cncf-kubevirt-security@lists.cncf.io
Lima	Security policy	GitHub Security Advisory
Metal3	Security policy	GitHub Security Advisory
Microcks	Security policy	security@microcks.io
NATS	⚠️ Missing	GitHub Security Advisory
OpenFGA	Security policy	security@openfga.dev
Tekton	Security policy	GitHub Security Advisory
wasmCloud	Security policy	security@wasmcloud.com

Sandbox

Project	Security policy	Report a vulnerability
Aeraki Mesh	Security policy	zhaohuabing@gmail.com
Agones	Security policy	GitHub Security Advisory
Akri	Security policy	cncf-akri-security@lists.cncf.io
Antrea	Security policy	cncf-antrea-maintainers@lists.cncf.io
Apicurio Registry	Security policy	cncf-apicurio-registery-security@lists.cncf.io
Armada	Security policy	GitHub Security Advisory
Athenz	⚠️ Missing	GitHub Security Advisory
Atlantis	Security policy	GitHub Security Advisory
Bank-Vaults	Security policy	team@bank-vaults.dev
BFE	Security policy	bfe-security@baidu.com
bootc	Security policy	GitHub Security Advisory
bpfman	Security policy	GitHub Security Advisory
Cadence Workflow	Security policy	GitHub Security Advisory
Capsule	Security policy	GitHub Security Advisory
Carina	⚠️ Missing	GitHub Security Advisory
Cartography	Security policy	cncf-cartography-maintainers@lists.cncf.io
Carvel	⚠️ Missing	GitHub Security Advisory
CDK for Kubernetes (CDK8s)	Security policy	cncf-cdk8s-security@lists.cncf.io
Chaosblade	⚠️ Missing	GitHub Security Advisory
CloudNativePG	Security policy	GitHub Security Advisory
Clusternet	⚠️ Missing	GitHub Security Advisory
Clusterpedia	⚠️ Missing	GitHub Security Advisory
CoHDI	⚠️ Missing	GitHub Security Advisory
Confidential Containers	Security policy	GitHub Security Advisory
Connect RPC	Security policy	⚠️ Missing
container2wasm	⚠️ Missing	GitHub Security Advisory
ContainerSSH	Security policy	GitHub Security Advisory
Copa	Security policy	GitHub Security Advisory
Cozystack	Security policy	GitHub Security Advisory
Curvine	Security policy	curvine86@gmail.com
Dalec	Security policy	GitHub Security Advisory
Devfile	Security policy	team-devfile-security@redhat.com
DevSpace	Security policy	security@loft.sh
Dex	Security policy	cncf-dex-maintainers@lists.cncf.io
Distribution	Security policy	cncf-distribution-security@lists.cncf.io
Drasi	Security policy	security@drasi.io
Easegress	Security policy	GitHub Security Advisory
Eraser	⚠️ Missing	GitHub Security Advisory
external-secrets	Security policy	cncf-ExternalSecretsOp-maintainers@lists.cncf.io
hami	Security policy	GitHub Security Advisory
Higress	Security policy	GitHub Security Advisory
HolmesGPT	Security policy	GitHub Security Advisory
HwameiStor	⚠️ Missing	GitHub Security Advisory
Hyperlight	Security policy	GitHub Security Advisory
Inclavare Containers	Security policy	security@inclavare-containers.io
Inspektor Gadget	⚠️ Missing	GitHub Security Advisory
Interlink	⚠️ Missing	GitHub Security Advisory
k0s	Security policy	cncf-k0s-maintainers@lists.cncf.io
k3s	Security policy	security@k3s.io
k8gb	Security policy	cncf-k8gb-maintainers@lists.cncf.io
K8sGPT	Security policy	contact@k8sgpt.ai
K8up	⚠️ Missing	GitHub Security Advisory
kagent	Security policy	kagent-vulnerability-reports@googlegroups.com
KAI Scheduler	Security policy	GitHub Security Advisory
Kairos	Security policy	GitHub Security Advisory
KAITO	Security policy	secure@microsoft.com
Kanister	Security policy	GitHub Security Advisory
kbind	Security policy	GitHub Security Advisory
KCL	⚠️ Missing	GitHub Security Advisory
kcp	Security policy	GitHub Security Advisory
Kepler	Security policy	GitHub Security Advisory
Keylime	⚠️ Missing	GitHub Security Advisory
Kgateway	Security policy	kgateway-vulnerability-reports@googlegroups.com
KitOps	Security policy	GitHub Security Advisory
Kmesh	Security policy	kmesh-security-vulnerability@googlegroups.com
ko	⚠️ Missing	GitHub Security Advisory
Konveyor	Security policy	konveyor-security@googlegroups.com
Koordinator	Security policy	kubernetes-security@service.aliyun.com
kpt	⚠️ Missing	⚠️ Missing
Krkn	Security policy	cncf-krkn-maintainers@lists.cncf.io
Kuadrant	Security policy	GitHub Security Advisory
Kuasar	⚠️ Missing	GitHub Security Advisory
Kube-burner	Security policy	GitHub Security Advisory
Kube-OVN	Security policy	cncf-Kube-OVN-maintainers@lists.cncf.io
kube-rs	Security policy	GitHub Security Advisory
kube-vip	⚠️ Missing	GitHub Security Advisory
Kubean	⚠️ Missing	GitHub Security Advisory
KubeArmor	Security policy	support@kubearmor.io
KubeClipper	⚠️ Missing	GitHub Security Advisory
KubeElasti	Security policy	GitHub Security Advisory
KubeFleet	Security policy	-distributors-announce@lists.cncf.io
Kuberhealthy	⚠️ Missing	GitHub Security Advisory
KubeSlice	Security policy	security@kubeslice.io
KubeStellar	Security policy	kubestellar-security-announce@googlegroups.com
Kubewarden	Security policy	GitHub Security Advisory
KUDO	⚠️ Missing	GitHub Security Advisory
Kuma	Security policy	GitHub Security Advisory
Kured	Security policy	cncf-kured-maintainers@lists.cncf.io
KusionStack	Security policy	kusionstack@gmail.com
llm-d	Security policy	llm-d-security-reporting@googlegroups.com
Logging Operator (Kube Logging)	Security policy	team@kube-logging.dev
LoxiLB	Security policy	loxilb-devel@netlox.io
Meshery	Security policy	GitHub Security Advisory
MetalLB	⚠️ Missing	GitHub Security Advisory
ModelPack	Security policy	GitHub Security Advisory
Network Service Mesh	⚠️ Missing	GitHub Security Advisory
NMstate	Security policy	GitHub Security Advisory
OAuth2 Proxy	Security policy	GitHub Security Advisory
Open Cluster Management	Security policy	OCM-security@googlegroups.com
Open Policy Containers	⚠️ Missing	GitHub Security Advisory
Open Workflow Specification	Security policy	GitHub Security Advisory
OpenChoreo	Security policy	GitHub Security Advisory
OpenEBS	Security policy	GitHub Security Advisory
OpenEverest	Security policy	GitHub Security Advisory
openGemini	⚠️ Missing	GitHub Security Advisory
OpenGitOps	Security policy	cncf-opengitops-maintainers@lists.cncf.io
OpenTofu	Security policy	GitHub Security Advisory
ORAS	Security policy	GitHub Security Advisory
OSCAL-COMPASS	Security policy	oscal-compass-oversight@googlegroups.com
OVN-Kubernetes	Security policy	GitHub Security Advisory
Oxia	⚠️ Missing	GitHub Security Advisory
Paralus	⚠️ Missing	GitHub Security Advisory
Parsec	Security policy	GitHub Security Advisory
Perses	Security policy	perses-team@googlegroups.com
PipeCD	Security policy	khanhtc1202@gmail.com
Piraeus Datastore	Security policy	GitHub Security Advisory
Pixie	Security policy	cncf-pixie-maintainers@lists.cncf.io
Podman Container Tools	Security policy	security@lists.podman.io
Podman Desktop	Security policy	cncf-podman-desktop-security@lists.cncf.io
Porter	Security policy	GitHub Security Advisory
Radius	Security policy	security@radapp.dev
Ratify	Security policy	GitHub Security Advisory
Runme Notebooks	⚠️ Missing	GitHub Security Advisory
SchemaHero	⚠️ Missing	GitHub Security Advisory
Score	Security policy	GitHub Security Advisory
Sermant	⚠️ Missing	GitHub Security Advisory
Serverless Devs	⚠️ Missing	GitHub Security Advisory
Shipwright	Security policy	shipwright-security@lists.cncf.io
SlimFaaS	Security policy	guillaume.chervet@axa.fr
SlimToolkit	Security policy	GitHub Security Advisory
SOPS	⚠️ Missing	GitHub Security Advisory
Spiderpool	⚠️ Missing	GitHub Security Advisory
SpinKube	Security policy	GitHub Security Advisory
Stacker	Security policy	GitHub Security Advisory
Submariner	⚠️ Missing	GitHub Security Advisory
Telepresence	Security policy	secalert@tada.se
Tinkerbell	⚠️ Missing	GitHub Security Advisory
Tokenetes	⚠️ Missing	GitHub Security Advisory
Tremor	Security policy	opensource@wayfair.com
Trickster	Security policy	GitHub Security Advisory
urunc	Security policy	GitHub Security Advisory
WasmEdge Runtime	Security policy	WasmEdge@googlegroups.com
zot	Security policy	GitHub Security Advisory

Unknown maturity

Project	Security policy	Report a vulnerability
cedar-policy	⚠️ Missing	⚠️ Missing
composefs	⚠️ Missing	⚠️ Missing