# Security Policy This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). ## How To Report a Vulnerability If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. **Please do not report security vulnerabilities through public issues, discussions, or pull requests.** Instead, report it using one of the following ways: * Contact the [Eclipse Foundation Security Team](mailto:security@eclipse-foundation.org) via email * Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/). Please include as much of the information listed below as you can to help us better understand and resolve the issue: * The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) * Affected version(s) * Impact of the issue, including how an attacker might exploit the issue * Step-by-step instructions to reproduce the issue * The location of the affected source code (tag/branch/commit or direct URL) * Full paths of source file(s) related to the manifestation of the issue * Configuration required to reproduce the issue * Log files that are related to this issue (if possible) * Proof-of-concept or exploit code (if possible) This information will help us triage your report more quickly.