---
title: "Security policy"
url: "/security/"
kind: "page"
summary: "How to report a security issue in Arion and how reports are handled."
---

> Arion site index: [/llms.txt](/llms.txt)

# Security policy

How to report a security issue in Arion and how reports are handled.

Arion sits on the request path of the systems it fronts, so we take security reports seriously and handle them privately.

## Report a vulnerability

If you believe you have found a security vulnerability in Arion, report it through GitHub's private vulnerability reporting: open the repository's [Security tab](https://github.com/arion-gateway/arion/security) and choose **Report a vulnerability**, or go straight to the [report form](https://github.com/arion-gateway/arion/security/advisories/new). The report is visible only to the maintainers.

> [!IMPORTANT]
> Never report a suspected vulnerability in a public issue, discussion or pull request. If you are unsure whether something is a security issue, report it privately anyway — we would rather triage a false alarm than read a vulnerability in the issue tracker.

## What to include

The same qualities that make a good bug report make a good security report:

- The Arion version or commit, and the deployment mode
- The smallest configuration that exhibits the problem, sanitised
- What an attacker can do: the impact as you understand it
- Steps to reproduce, or a proof of concept if you have one

## What to expect

We are a small team and respond on a best-effort basis. We read every report, acknowledge it as quickly as we can, and keep you updated while we assess it. For a confirmed vulnerability we develop and release a fix, publish a GitHub security advisory — with a CVE where warranted — and credit you in it, unless you prefer otherwise.

## Coordinated disclosure

We ask you to keep the details of a report private until a fix is released and the advisory is published. We will work with you on the timing, and we will not take action against good-faith research conducted under this policy.

## Scope

This policy covers the [Arion codebase](https://github.com/arion-gateway/arion); fixes land in the latest release. Problems with this website are not security reports — an ordinary [issue](https://github.com/arion-gateway/arion/issues) is the right place for those.