## Report a Vulnerability

We're extremely grateful for security researchers and users that report
vulnerabilities to the CRI-O community. All reports are thoroughly investigated
by a set of community volunteers.

To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).

### When Should I Report a Vulnerability?

- You think you discovered a potential security vulnerability in CRI-O
- You are unsure how a vulnerability affects CRI-O
- You think you discovered a vulnerability in another project that CRI-O depends
  on (for projects with their own vulnerability reporting and disclosure
  process, please report it directly there)

### When Should I NOT Report a Vulnerability?

- You need help tuning CRI-O components for security
- You need help applying security related updates
- Your issue is not security related
