If you find a potential security vulnerability, please email security@ckan.org. Do not create a public issue or pull request on GitHub.

We aim to respond to all valid reports within three working days.

The team reviewing the reports has limited time, please be mindful of this when submitting a report:

• Keep the report concise and to the point. Provide information on the versions affected, a short description of the vulnerability and ideally a way to reproduce it.
• Do not directly submit reports generated by AI tools. These are almost always too verbose and contain unnecessary details. Please review and edit the report yourself. Reports should come from a human, not a tool.

Security updates are offered for the 2 most recent minor CKAN releases. It is critical to always run the latest patch release for a minor version. To find out the currently supported versions and learn more about CKAN releases see here:

https://docs.ckan.org/en/latest/maintaining/releases.html

Fixed security vulnerabilities are assigned a CVE and registered using GitHub Security Advisories, and also included in the CHANGELOG.rst.

Again, only the latest patch release contains all security patches, so please ensure your CKAN instance is running on a supported version to avoid exposing your users and your data.