<!--
SPDX-FileCopyrightText: Copyright 2020-2021, 2023, 2025 Arm Limited and/or its affiliates <open-source-office@arm.com>

SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the License); you may
not use this file except in compliance with the License.
You may obtain a copy of the License at

www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an AS IS BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
# Vela Security Vulnerabilities

If you believe you have identified a security related issue or vulnerability,
then we encourage you to responsibly disclose it to us as soon as possible.
For non-security related issues please see [Bug Reporting](BUGS.md).

## Reporting vulnerabilities

Arm takes security issues seriously and welcomes feedback from researchers
and the security community in order to improve the security of its products
and services.  We operate a coordinated disclosure policy for disclosing
vulnerabilities and other security issues.

Security issues can be complex and one single timescale doesn't fit all
circumstances.  We will make best endeavours to inform you when we expect
security notifications and fixes to be available and facilitate coordinated
disclosure when notifications and patches/mitigations are available.

### Report

For all security issues, contact Arm Product Security Incident Response Team (PSIRT)
by email at [psirt@arm.com](mailto:psirt@arm.com). In the body of the email
include as much information as possible about the issue or vulnerability and any
additional contact details.

### Secure submission using PGP

We support and encourage secure submission of vulnerability reports using PGP
with the key found at [Report Security Vulnerability](https://developer.arm.com/support/arm-security-updates/report-security-vulnerabilities).
If you would like replies to be encrypted, please provide your own public key
through a secure mechanism.

For more information visit
<https://developer.arm.com/support/arm-security-updates/report-security-vulnerabilities>
