At commercetools, we take the security of our software and our customers' data seriously. Thank you for helping us keep our open source projects safe.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately using GitHub Private Vulnerability Reporting: open the Security tab of the affected repository and select Report a vulnerability.

Please include as much of the following as possible:

• The affected repository, version, and component
• A description of the issue and its potential impact
• Steps to reproduce, or a proof of concept
• Any suggested mitigation or fix

We review reports as soon as we reasonably can and may contact you for more information. We ask that you give us a reasonable amount of time to investigate and fix the issue before any public disclosure.

This policy covers open source repositories in the commercetools GitHub organization.

It does not cover:

• The commercetools platform and hosted services.
• Third-party dependencies. Please report those to their maintainers.

For more on how we approach security, see the commercetools Trust Center.