<commit_before>---
title: Security Vulnerabilities
description: How we handle security vulnerabilities.
weight: 35
icon: vulnerabilities
---

We are very grateful to the security researchers and users that report
back Istio security vulnerabilities. We investigate every report thoroughly.

## Reporting a vulnerability

To make a report, send an email to the private
[<EMAIL>](mailto:<EMAIL>)
mailing list with the vulnerability details. For normal product bugs
unrelated to latent security vulnerabilities, please head to
our [Reporting Bugs](/about/bugs/) page to learn what to do.

### When to report a security vulnerability?

Send us a report whenever you:

- Think Istio has a potential security vulnerability.
- Are unsure whether or how a vulnerability affects Istio.
- Think a vulnerability is present in another project that Istio
depends on. For example, Envoy, Docker, or Kubernetes.

When in doubt, please disclose privately. This includes, but is not limited to:
* Any crash, especially in Envoy
* Any security policy (like Authentication or Authorization) bypass or weakness
* Any potential Denial of Service (DoS)<commit_msg>Fix list in docs (#8315)<commit_after>---
title: Security Vulnerabilities
description: How we handle security vulnerabilities.
weight: 35
icon: vulnerabilities
---

We are very grateful to the security researchers and users that report
back Istio security vulnerabilities. We investigate every report thoroughly.

## Reporting a vulnerability

To make a report, send an email to the private
[<EMAIL>](mailto:<EMAIL>)
mailing list with the vulnerability details. For normal product bugs
unrelated to latent security vulnerabilities, please head to
our [Reporting Bugs](/about/bugs/) page to learn what to do.

### When to report a security vulnerability?

Send us a report whenever you:

- Think Istio has a potential security vulnerability.
- Are unsure whether or how a vulnerability affects Istio.
- Think a vulnerability is present in another project that Istio
depends on. For example, Envoy, Docker, or Kubernetes.

When in doubt, please disclose privately. This includes, but is not limited to:

- Any crash, especially in Envoy
- Any security policy (like Authentication or Authorization) bypass or weakness
- Any potential Denial of Service (DoS)
{'fraction_non_alphanumeric': 0.057926829268292686, 'fraction_numerical': 0.003484320557491289, 'mean_word_length': 4.815189873417721, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2361997', 'n_tokens_mistral': 591, 'n_tokens_neox': 550, 'n_words': 315}