If you believe you have found a security vulnerability in Gnocchi, please report it privately so that it can be investigated and addressed before details are publicly disclosed.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or other public channels.

The preferred way to report a security vulnerability is through GitHub's Private Vulnerability Reporting feature.

For instructions on how to submit a private vulnerability report, please refer to the official GitHub documentation:

Privately reporting a security vulnerability

When reporting a vulnerability, please provide as much relevant information as possible, including:

• A description of the vulnerability and its potential impact.
• The affected versions or commits.
• Steps to reproduce the issue.
• A minimal proof of concept, if available.
• Relevant configuration or environmental details.
• Suggested mitigations or fixes, if available.

We ask security researchers to make a reasonable effort to avoid:

• Accessing, modifying, or deleting data that does not belong to them.
• Disrupting the availability or operation of Gnocchi or systems using it.
• Obtaining or exposing credentials, personal information, or other sensitive data.
• Publicly disclosing a vulnerability before maintainers have had a reasonable opportunity to investigate and address it.

We appreciate responsible reports that help improve the security of Gnocchi and the wider open source ecosystem.

Security fixes and advisories will be published through the project's GitHub security advisories and other appropriate project communication channels when disclosure is appropriate.