PingCAP · Vulnerability Disclosure

Pingcap Vulnerability Disclosure

Vulnerability disclosure

PingCAP publishes a vulnerability disclosure policy for reporting security issues. A dedicated security contact is published.

Distributed SQLDatabasetidbhtapmysql-compatibleCloud DatabaseDatabase-as-a-ServiceVector SearchData MigrationChange Data CaptureOpen-SourceInfrastructure

Program:

Disclosure Policy

Policy

https://www.pingcap.com/security/

Security Contact

Contact

security@pingcap.com

Source

Vulnerability Disclosure

generated: '2026-08-02'
method: searched
probe: true
source: https://www.pingcap.com/security/
program_name: PingCAP Security Vulnerabilities Guidelines
policy:
- https://www.pingcap.com/security/
contact:
- security@pingcap.com
security_txt:
  present: false
  probed_hosts:
  - www.pingcap.com
  - docs.pingcap.com
  - api.tidbcloud.com
  - serverless.tidbapi.com
  - dedicated.tidbapi.com
  - iam.tidbapi.com
  - billing.tidbapi.com
  - dataservice.tidbapi.com
  - zero.tidbapi.com
  note: No /.well-known/security.txt (RFC 9116) on any host — 404 or 403 everywhere. The disclosure policy exists
    but is not machine-discoverable.
bug_bounty:
  present: true
  platform: self-hosted (email intake)
  reward_range: USD 50 to USD 5,000, tiered by severity and business impact
  severity_ratings:
  - Critical
  - High
  - Medium
  - Low
  - Ignored
scope:
  in_scope:
  - tidbcloud.com
  - tidb-cloud.com
  - tidbapi.com
  - pingcap.com
  - PingCAP open-source products (TiDB, TiKV, TiFlash, PD and related components)
  prohibited:
  - denial-of-service testing
  - data extraction
  - destructive actions
  confidentiality: Reporters must keep findings confidential until a patch is released.
evidence:
- source: https://www.pingcap.com/security/
  kind: disclosure page
  keywords:
  - vulnerability
  - security research
  - security issue
  - security@
  - reward

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/pingcap-vulnerability-disclosure"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.