Gloo Vulnerability Disclosure

generated: '2026-09-12'
method: searched
probe: true
source: https://www.solo.io/security
provider: Gloo
providerId: gloo
description: >-
  Solo.io publishes a coordinated vulnerability disclosure process covering every product and
  project it leads, including Gloo Edge, Gloo Gateway / Solo Enterprise for kgateway, Gloo Mesh
  and Gloo Portal. The policy is published as an ordinary web page; there is no
  /.well-known/security.txt on any Solo.io host (see well-known/gloo-well-known.yml).
policy:
  url: https://www.solo.io/security
  http_status: 200
  contact: security@solo.io
  contact_type: private mailing list
  pgp_key: null
  bug_bounty: false
  bug_bounty_platform: null
  safe_harbor_stated: false
  acknowledgement_sla: 3 work days
  scope_note: >-
    Reports are invited for any product or project led by Solo.io, for uncertainty about
    whether a vulnerability affects a specific technology, and for vulnerabilities in upstream
    dependencies the products rely on — Solo.io names Envoy, Docker, Istio and Kubernetes
    explicitly.
process:
  - step: report
    detail: Email the private security@solo.io mailing list with the vulnerability details. Ordinary non-security product bugs go to the relevant project issue tracker instead.
  - step: evaluate
    detail: The Solo.io security team acknowledges and analyzes each report within three work days, keeps the reporter updated, and does not disseminate report contents to other projects except as needed to fix the issue.
  - step: fix
    detail: Once characterized, the fix is developed and tested in a PRIVATE GitHub repository to prevent premature disclosure.
  - step: disclose
    detail: On the chosen disclosure day the fix is merged to public branches, binaries are built, and announcements go out via the Solo.io blog, @soloio_inc, the Solo.io Slack #general channel, and email to paid support customers.
disclosure_channels:
  - https://www.solo.io/blog
  - https://twitter.com/soloio_inc
  - https://solo-io.slack.com
  - paid support customer email
evidence:
  - source: https://www.solo.io/security
    http_status: 200
    kind: disclosure policy page
    fetched: '2026-09-12'
    keywords:
      - security@solo.io
      - Reporting a vulnerability
      - within three work days
      - private GitHub repository
      - Public disclosure
  - source: https://www.solo.io/.well-known/security.txt
    http_status: 404
    kind: RFC 9116 probe
    fetched: '2026-09-12'
    note: Not served. solo.io answers every /.well-known/ path with a fixed "Invalid .well-known request" page under HTTP 404.
gaps:
  - No /.well-known/security.txt, so the policy is not machine-discoverable.
  - No PGP/OpenPGP key published for encrypted reports.
  - No bug bounty and no stated safe-harbor / legal-protection language for researchers.
  - No published CVE or security-advisory index page; advisories are distributed by blog, Slack, X and customer email.