# Security Vulnerability Disclosure and Response Process

Cloud Storage Engine (CSE) is the storage engine behind the cloud-native, shared-storage architecture of TiDB X.

To ensure the security of CSE and related TiDB Cloud components, we follow a security vulnerability disclosure and response process.

The primary goal of this process is to reduce the total exposure time of users to publicly known vulnerabilities. To quickly fix vulnerabilities in Cloud Storage Engine and related TiDB Cloud components, the PingCAP security team is responsible for the vulnerability management process, including internal communication, remediation coordination, and external disclosure.

# Reporting a Vulnerability

If you find a vulnerability or encounter a security incident involving Cloud Storage Engine, please report it as soon as possible to the PingCAP security team:

security@pingcap.com

Please kindly provide as much vulnerability information as possible in the following format:

- Issue title*:
- Overview*:
- Affected components and version number*:
- CVE number, if any:
- Vulnerability verification process*:
- Impact assessment:
- Contact information*:

The asterisk (*) indicates a required field.

# Response Time

The PingCAP security team will confirm the vulnerability report and contact you within 2 working days after your submission.

We will publicly thank you once the security vulnerability has been fixed, unless you prefer to remain anonymous. To avoid negative impact, please keep the vulnerability confidential until we have completed remediation and coordinated disclosure.

We would appreciate it if you could follow this code of conduct:

- The vulnerability should not be publicly disclosed until a patch or mitigation has been released.
- Details of the vulnerability, including exploit code or proof-of-concept details, should not be publicly disclosed before coordinated disclosure.