PingCAP · Vulnerability Disclosure

Pingcap Vulnerability Disclosure

Vulnerability disclosure

PingCAP publishes a vulnerability disclosure policy for reporting security issues. A dedicated security contact is published.

Distributed SQLDatabasetidbhtapmysql-compatibleCloud DatabaseDatabase-as-a-ServiceVector SearchData MigrationChange Data CaptureOpen-SourceInfrastructure
Program:

Disclosure Policy

Policy
https://www.pingcap.com/security/

Security Contact

Contact
security@pingcap.com

Source

Vulnerability Disclosure

Raw ↑ 
generated: '2026-08-02'
method: searched
probe: true
source: https://www.pingcap.com/security/
program_name: PingCAP Security Vulnerabilities Guidelines
policy:
- https://www.pingcap.com/security/
contact:
- security@pingcap.com
security_txt:
  present: false
  probed_hosts:
  - www.pingcap.com
  - docs.pingcap.com
  - api.tidbcloud.com
  - serverless.tidbapi.com
  - dedicated.tidbapi.com
  - iam.tidbapi.com
  - billing.tidbapi.com
  - dataservice.tidbapi.com
  - zero.tidbapi.com
  note: No /.well-known/security.txt (RFC 9116) on any host — 404 or 403 everywhere. The disclosure policy exists
    but is not machine-discoverable.
bug_bounty:
  present: true
  platform: self-hosted (email intake)
  reward_range: USD 50 to USD 5,000, tiered by severity and business impact
  severity_ratings:
  - Critical
  - High
  - Medium
  - Low
  - Ignored
scope:
  in_scope:
  - tidbcloud.com
  - tidb-cloud.com
  - tidbapi.com
  - pingcap.com
  - PingCAP open-source products (TiDB, TiKV, TiFlash, PD and related components)
  prohibited:
  - denial-of-service testing
  - data extraction
  - destructive actions
  confidentiality: Reporters must keep findings confidential until a patch is released.
evidence:
- source: https://www.pingcap.com/security/
  kind: disclosure page
  keywords:
  - vulnerability
  - security research
  - security issue
  - security@
  - reward

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/pingcap-vulnerability-disclosure"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.