Security is our top priority and we proactively look for ways to improve the security of our products. Our security program is transparent so you can be confident when using our products for mission-critical projects.
We welcome all contributions from our user community, developers, and security researchers to reinforce our product security. You could even be recognized in our security hall of fame for disclosing vulnerabilities responsibly!
We strongly encourage you to report security vulnerabilities to our private and highly confidential security mailing list: [email protected] first, before disclosing them in any forums, sites or other groups - public or private.
If you wish to send secure messages to [email protected], you may use the following key: [email protected]: F0AB 72EC D77A 6162 4C48 A245 0CF3 FD36 E100 FF07 pgp.mit.edu
View clarifications for CVEs of WSO2 products.
View security advisories for WSO2 products.
View a list of security researchers that reported security vulnerabilities in WSO2 products.
Read about our security processes and programs to understand how we manage various aspects of security in our products.
How WSO2 enforces security practices at each phase of the Software Development Life Cycle.
How WSO2 manages security issues that are identified internally as well as reported by our customers and external researchers.
How WSO2 shows appreciation for responsibly disclosing vulnerabilities of its products.
Read our guidelines to understand how to enforce security-first development and deployment practices.
How to enhance the security of WSO2 products in your production deployment.
Security best practices and processes followed in the SDLC of WSO2 products and services.