Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report security vulnerabilities directly to the security team:

• Email: measure@i-dacs.com
• Subject line: [SECURITY] rekuiper vulnerability report

Include this information in the report:

• A description of the vulnerability.
• The affected component (such as the SQL engine, REST API, or a specific connector).
• Steps to reproduce the vulnerability.
• Applicable configuration files, log files, or error messages.

1. Acknowledgment: The security team sends an acknowledgment within 48 hours.
2. Investigation and Correction: The team reproduces the problem in an isolated environment and prepares a correction.
3. Release and Advisory: The project publishes a new software release and a security advisory.
4. Coordinated Disclosure: Keep vulnerability details confidential until the project publishes the security release.

Maintained by I-Dacs Labs
measure@i-dacs.com · i-dacs.com