We appreciate every effort to discover and responsibly disclose security vulnerabilities in Databend.

Please do not open a public GitHub issue for security problems.

Email security@databend.com with:

• a description of the issue and its impact
• the Databend version or commit you tested against
• steps or a script to reproduce (SQL, curl/mysql transcripts, crafted files, or a Rust test)
• the user/role you ran as, for isolation or privilege findings

We will acknowledge your report within 3 business days, keep you informed of progress, and credit you in the release notes unless you prefer otherwise.

In scope: anything reachable by a database user over the HTTP, MySQL or Arrow Flight SQL handlers, including cross-tenant access, authentication or RBAC bypass, row access policy / data masking bypass, credential exposure, SSRF through stage or connection URIs, memory safety when parsing staged files or table metadata, and UDF sandbox escapes.

Out of scope: issues that require operator-level access (configuration files, CLI flags, the admin API and metrics ports), vulnerabilities in dependencies that Databend does not reach, and findings that only affect test harnesses or CI scripts.

Security fixes land on main and are included in the next nightly and stable release. We do not backport to older release lines unless the issue is critical and widely deployed.