Celery · Vulnerability Disclosure

Celery Vulnerability Disclosure

Vulnerability disclosure

Celery runs a coordinated vulnerability disclosure program on Hackerone.

AsynchronousDistributed SystemsMessage QueueOpen SourcePythonTask QueueReal-Time
Program: Hackerone

Disclosure Policy

Security Contact

Source

Vulnerability Disclosure

celery-vulnerability-disclosure.yml Raw ↑ 
generated: '2026-09-05'
method: searched
source: >-
  https://github.com/celery/celery/blob/main/SECURITY.md,
  https://github.com/celery/celery/security/policy
published: true
policy_url: https://github.com/celery/celery/security/policy
policy_file: https://github.com/celery/celery/blob/main/SECURITY.md
channel: email to the maintainers named in SECURITY.md
channel_note: >-
  The policy directs reporters to email two named maintainers. Their personal addresses are
  published in SECURITY.md but are deliberately NOT transcribed here — read them from the source
  file. GitHub private security advisories are not offered as an alternative in the policy text.
security_txt: false
security_txt_note: >-
  No RFC 9116 /.well-known/security.txt is served on any host (see
  well-known/celery-well-known.yml — 404 on docs.celeryq.dev, www.celeryq.dev; celeryq.dev does not
  resolve). The disclosure route is GitHub-only.
bug_bounty:
  program: none
  platforms_checked: [hackerone, bugcrowd, intigriti]
  result: no program found
supported_versions:
  as_published:
    - version: 5.4.x
      supported: true
    - version: 5.3.x
      supported: false
    - version: 5.2.x
      supported: false
    - version: 5.1.x
      supported: false
    - version: '<5.0'
      supported: false
  finding: >-
    The published support matrix is stale: it names 5.4.x as the only supported line while the
    current release is 5.6.3 (2026-03-26) and the 5.5/5.6 series have both shipped since. A reporter
    reading the policy cannot tell which lines will actually receive a fix.
disclosure_timeline: not stated
safe_harbour: not stated
cve_history_url: https://github.com/celery/celery/security/advisories

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/celery-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.