.. _docs-security:

========
Security
========
Pigweed is committed to delivering reliable, safe, and secure software and tools
that can be used to build products with the same characteristics.

If you found a vulnerability, learn
:ref:`how to report it <docs-contributing-security>`.

If you have a concern about Pigweed's security, please do not hesitate to
:ref:`contact us <docs-contributing-help>`.

.. toctree::
   :hidden:
   :maxdepth: 1

   Report a vulnerability <../contributing/security>
   Agentic threat model <threat_model>
   Handling false positives <false_positives>

.. _docs-security-bulletins:

------------------
Security bulletins
------------------
Pigweed encourages its consumers to `live at HEAD
<https://abseil.io/about/philosophy#we-recommend-that-you-choose-to-live-at-head>`_.
Lower severity defects will simply be fixed in the upstream repository without
any special notice, so staying up-to-date is the best way to get Pigweed fixes
as soon as they are available.

Pigweed includes notices of critical and high severity vulnerabilities and their
fixes in monthly security bulletins. These bulletins include the revision that
fixes each vulnerability to allow you to cherry-pick the fix if you are not
able to stay up-to-date.

.. toctree::
   :maxdepth: 2

   2026/index