PingCAP · Vulnerability Disclosure

Pingcap Vulnerability Disclosure

Vulnerability disclosure

PingCAP publishes a vulnerability disclosure policy for reporting security issues. A dedicated security contact is published.

distributed-sqldatabasetidbhtapmysql-compatiblecloud-databasedbaasvector-searchdata-migrationchange-data-captureopen-sourceinfrastructure
Program:

Disclosure Policy

Policy
https://www.pingcap.com/security/

Security Contact

Contact
security@pingcap.com

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-02'
method: searched
probe: true
source: https://www.pingcap.com/security/
program_name: PingCAP Security Vulnerabilities Guidelines
policy:
- https://www.pingcap.com/security/
contact:
- security@pingcap.com
security_txt:
  present: false
  probed_hosts:
  - www.pingcap.com
  - docs.pingcap.com
  - api.tidbcloud.com
  - serverless.tidbapi.com
  - dedicated.tidbapi.com
  - iam.tidbapi.com
  - billing.tidbapi.com
  - dataservice.tidbapi.com
  - zero.tidbapi.com
  note: No /.well-known/security.txt (RFC 9116) on any host — 404 or 403 everywhere. The disclosure policy exists
    but is not machine-discoverable.
bug_bounty:
  present: true
  platform: self-hosted (email intake)
  reward_range: USD 50 to USD 5,000, tiered by severity and business impact
  severity_ratings:
  - Critical
  - High
  - Medium
  - Low
  - Ignored
scope:
  in_scope:
  - tidbcloud.com
  - tidb-cloud.com
  - tidbapi.com
  - pingcap.com
  - PingCAP open-source products (TiDB, TiKV, TiFlash, PD and related components)
  prohibited:
  - denial-of-service testing
  - data extraction
  - destructive actions
  confidentiality: Reporters must keep findings confidential until a patch is released.
evidence:
- source: https://www.pingcap.com/security/
  kind: disclosure page
  keywords:
  - vulnerability
  - security research
  - security issue
  - security@
  - reward