Respond: Define processes to report, triage, and
respond to vulnerabilities or attacks.

Recover: Build capabilities to contain and recover
from an incident with minimal impact.

Reporting vulnerabilities

Before reporting a security vulnerability found
by a static analysis tool,
consider checking our list of known false positives.

To report a vulnerability, email security@flutter.dev
with a description of the issue,
the steps you took to create the issue,
affected versions, and if known, mitigations for the issue.

We should reply within three working days.

We use GitHub’s security advisory feature to track
open security issues. You should expect a close collaboration
as we work to resolve the issue that you have reported.