Security

Apache Burr follows the ASF vulnerability handling process.

If you believe you have found a security vulnerability in Burr, report it privately by email to security@apache.org. Do not open a GitHub issue or post to the dev@burr.apache.org list.

The project’s security model – which parties Burr trusts, what it guarantees, and what is out of scope – is documented in SECURITY.md in the source repository. Read it before reporting to check whether an issue is a Burr vulnerability or a deployment concern.