| .. _docs-security: |
| |
| ======== |
| Security |
| ======== |
| Pigweed is committed to delivering reliable, safe, and secure software and tools |
| that can be used to build products with the same characteristics. |
| |
| If you found a vulnerability, learn |
| :ref:`how to report it <docs-contributing-security>`. |
| |
| If you have a concern about Pigweed's security, please do not hesitate to |
| :ref:`contact us <docs-contributing-help>`. |
| |
| .. toctree:: |
| :hidden: |
| :maxdepth: 1 |
| |
| Report a vulnerability <../contributing/security> |
| Agentic threat model <threat_model> |
| Handling false positives <false_positives> |
| |
| .. _docs-security-bulletins: |
| |
| ------------------ |
| Security bulletins |
| ------------------ |
| Pigweed encourages its consumers to `live at HEAD |
| <https://abseil.io/about/philosophy#we-recommend-that-you-choose-to-live-at-head>`_. |
| Lower severity defects will simply be fixed in the upstream repository without |
| any special notice, so staying up-to-date is the best way to get Pigweed fixes |
| as soon as they are available. |
| |
| Pigweed includes notices of critical and high severity vulnerabilities and their |
| fixes in monthly security bulletins. These bulletins include the revision that |
| fixes each vulnerability to allow you to cherry-pick the fix if you are not |
| able to stay up-to-date. |
| |
| .. toctree:: |
| :maxdepth: 2 |
| |
| 2026/index |
