# Security Policy

## Reporting a Vulnerability

We encourage responsible disclosure of security vulnerabilities. If you
find something suspicious, we encourage and appreciate your report.

The preferred way to report a vulnerability is to use the
**"Report a vulnerability"** button under the **Security** tab of the
OpenZFS GitHub repository. This creates a private communication channel
between you and the maintainers, allowing us to review the report
confidentially and respond as quickly as possible.

Please include, if possible:

- A clear description of the issue
- Steps to reproduce the problem
- Affected versions or branches
- Any proof of concept, logs, or screenshots
- Your assessment of the potential impact

## What to Expect

- We will review security reports as soon as practical.
- We may ask follow-up questions to better understand the issue.
- Please allow time for investigation and coordination before public
  disclosure.
- If the issue is confirmed, we will work on a fix and release a security
  update as needed for supported OpenZFS versions.