<!--- SPDX-License-Identifier: Apache-2.0 -->

# Security Policy

## Reporting a Vulnerability
If you think you have found a security vulnerability, please send a report to onnx-security@lists.lfaidata.foundation. Please do not post security vulnerabilities on Slack.

We don't currently have a PGP key, unfortunately.

An ONNX committer will send you a response indicating the next steps in handling your report. After the initial reply to your report, the committer will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

Important: Please don't disclose the vulnerability before it has been fixed and announced, to protect our users.

## Security announcements
Please subscribe to the [announcements mailing list](https://lists.lfaidata.foundation/g/onnx-announce), where we post notifications and remediation details for security vulnerabilities.
