# Security Policy

## Reporting a Vulnerability

If you think that you have found a security issue,
don’t use the bug tracker and don’t publish it publicly.
Instead, all security issues must be reported via 📫 to [security-issue@pimcore.com](mailto:security-issue@pimcore.com).


## Resolving Process
Every submitted security issue is handled with top priority by following these steps:

1. Confirm the vulnerability
2. Determine the severity
3. Contact reporter
4. Work on a patch
5. Get a CVE identification number (may be done by the reporter or a security service provider)
6. Patch reviewing
7. Tagging a new release for supported versions
8. Publish security announcement