Puppet Labs Security

Introduction

Puppet Labs takes the security of its products very seriously.  We respond to security issues and concerns promptly and when necessary release new versions of the product to address vulnerabilities or security issues in our products.

Security Policy

Puppet Labs supports responsible disclosure of security vulnerabilities.

Puppet Labs is happy to fully disclose all details of a security vulnerability but in the interests of responsible disclosure we do ask security researchers and other stakeholders to allow us sufficient time to patch the vulnerability before publishing the details.

We have a strong relationship with all of our Linux distribution maintainers, and appreciate it when we have sufficient time to perform patch coordination with them before public disclosure. If you report an issue to us directly, we will coordinate this process.

We believe in giving credit to security researchers if they so desire. When reporting an issue to us, please let us know whether you would like to be publicly credited, and how you would like to be identified.

Security Reporting Process

If you have identified an issue then please send an email to the Security mailbox with the details.  If you wish to contact us via phone to report a security issue please call 1-877-575-9775.

Security Disclosures