Submariner welcomes and appreciates the responsible disclosure of security vulnerabilities. This document describes which versions receive security fixes and how to report a vulnerability.

Security fixes are made on the devel branch and, when they address serious issues or regressions, are backported to the actively maintained release branches following the project's backports process. The set of maintained branches tracks the most recent Submariner releases; see the releases documentation for the current list.

The following branches currently receive backported fixes, based on recent commit activity. This list is a best-effort snapshot rather than a formal policy; if it's out of date, please open an issue or pull request to correct it.

If you know of a security issue with Submariner, please report it privately by email to submariner-security@googlegroups.com rather than opening a public issue or pull request.

For full details, follow the project's security reporting process.

Submariner Project Owners receive security disclosures by default. They may share disclosures with others as required to make and propagate fixes.