Snapshot 3515
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Download the New 2026 State of Open Source Database Management Report See all results → Downloads Blog Contact Us Percona Security This page provides information about the correct and necessary actions to take when security concerns about Percona software arise. Some information applies to Percona customers, some to non-customers using Percona software, and some to both groups. Reporting a Security Concern to Percona For Percona Customers: Please create a ticket using our customer portal For Non-Customers: You can email [email protected] Reporting a Security Concern about Percona Open Source Software For Percona Customers: Please create a ticket using our customer portal For Non-Customers: Please create a ticket at https://jira.percona.com If you have any concerns about the content being sensitive, please report the issue to [email protected]. Regarding CVEs that Affect Percona OSS Percona open-source software merges upstream code releases. To allow Percona time to integrate enhancements and perform quality assurance testing, delays may occur after an upstream release to the equivalent Percona release. Percona naming conventions follow upstream. For example, Percona Software version 1.2.3-55.0 breaks down into 1.2.3 being the upstream version the product is equivalent to, with -55.0 being the Percona-specific revisions and enhancements against the upstream version. Responsible Disclosure Percona operates a Responsible Disclosure program for legitimate reported issues that affect Percona or potentially affect Percona customers or Percona software users. Scope Percona Open Source Software Percona web properties Note: exclusions below. Exclusions We are no longer accepting reports that include the following: Public Content on jira.percona.com / perconadev.atlassian.net: jira.percona.com is our public open-source software bug tracking system. All content is intended to be public on this service. We will no longer accept reports noting public content as a misconfiguration or exposure DMARC, SPF: We are aware of DMARC and SPF and are working towards better implementations of both DNS CNAME Denoting Third-Party SaaS Services: These are not operated by Percona. While we welcome reports of concern, we cannot provide any reward for such reports. Please note the DNS CNAME for the responsible parties Report Details Percona requests that your report includes at a minimum the following details for consideration: The target, including a fully qualified domain name, if applicable The vulnerability being reported, including proof of concept exploitation if applicable Core dump/stack traces of the affected issue being exploited if applicable Configuration files/SQL/related scripts and/or details for the affected issue being reported Any system configuration detail that is relevant to the issue being reported Any intended timelines for disclosure Note: For bounty consideration, you must be open to negotiating timelines where appropriate. Grounds for Rejection Percona’s Security Team will make every effort to work with security researchers, provided they comply with the terms above. Reports received that do not detail the issue or make an attempt to do so may be rejected outright. The Percona Security Team will make every effort to work with researchers to thoroughly understand the issue being reported, and agree on a timeframe for a fix where applicable. Percona implements automated email filtering to limit the delivery of spam, malware, etc. Please ensure when emailing your report to include a valid email address to respond to, a subject line, and email body content to ensure delivery. Prohibited Testing The following testing activities are prohibited under the Responsible Disclosure and Bug Bounty program. Any testing that includes any of the following will result in action being taken to restrict such activity and/or refer to law enforcement agencies where appropriate: Any testing that may cause a service loss for any Percona web property or Percona-operated system (e.g., DoS, DDoS) Any testing that involves the solicitation, extortion, coercion, or exploitation of Percona staff in any way Any testing that involves fuzzing without prior authorization Any testing that would yield unauthorized junk, spam, phishing, or other unsolicited mail Any testing that would involve the upload or distribution of malicious payloads Any testing that originated from territories under U.S. Sanction Any actions prohibited by Percona’s Acceptable Use Policy (see Section 9 of the Terms of Use at https://www.percona.com/terms-use) Any testing of the web properties noted as excluded from scope Should you have a legitimate test case that might include one of the above, please contact [email protected] detailing your proposed test, expected outcome, and proposed timelines. Compensation / Bounty Percona is grateful for any contributions made to the Responsible Disclosure program at Percona. Percona at this time does not offer an official bounty program. In cases where a report is thought to warrant some reward, the Percona Security and Managerial teams, at their discretion, may provide rewards ranging from swag to monetary compensation where deemed appropriate. The Percona Trust Center Security and compliance shouldn't be a black box. The Percona Trust Center gives you on-demand access to the documentation, certifications, and answers you need to evaluate Percona with confidence. Certifications and badges: ISO 27001, GDPR, HIPAA, and PCI Featured documents, including the ISO 27001:2022 Certificate, ISO 27001 Certification Audit Report, 2025 Pentest Report, Percona SAQ-D for reporting year 2025, Data Transfer Impact Assessment, InfoSec Policy, Data Classification Policy, Vendor Risk Management Policy, Security Incident Policy, Risk Assessment and Treatment Policy, and Personal Data Handling and Protection Policy A complete subprocessor list covering all 18 third parties Percona works with, including AWS, Google Workspace, Salesforce, ServiceNow, HubSpot, Slack, and Zoom, with locations of processing and usage details A searchable knowledge base with 447 FAQs across security governance, compliance, privacy, network security, risk and vulnerability management, AI, and more Filtered views by service line: Consulting, Database Support, Managed Services, and Open Source Software A direct channel to ask a security question or request documents that aren't already published At a glance, Percona: Completes annual third-party audits and annual third-party penetration testing Maintains a disaster recovery plan and cyber insurance Operates a bug bounty and vulnerability disclosure program Will enter into a DPA and deletes customer data on request Uses centralized SSO to manage employee access Whether you're running a vendor review, refreshing a security questionnaire, or doing routine due diligence, the Trust Center is the fastest way to get what you need. Visit the Percona Trust Center (at https://trust.percona.com/) Reporting a privacy concern to Percona Percona is committed to protecting your privacy. You can read our Privacy Policy, including your choices regarding the collection, use, and sharing of your data. Read Our Privacy Policy Open source database software from experts who stand with you in production. Forever free from lock-in and other corporate BS. Connect © 2026 Percona All Rights Reserved Database Technology PostgreSQL MySQL MariaDB MongoDB Valkey / Redis Databases on Kubernetes Monitoring & Management (PMM) Percona Toolkit Services Expert Support ExpertOps Expert Consulting Training Solution Bundles Subscription Policies Use Cases Cost Optimization Performance and Reliability Sovereignty, Security, and Compliance AI and Future Readiness Company About Percona Partners Careers Events Press Releases News Terms of Use | Privacy | Copyright | Legal | Security Center MySQL, PostgreSQL, InnoDB, MariaDB, MongoDB and Kubernetes are trademarks for their respective owners. © 2026 Percona All Rights Reserved Product Group Version Platform Package Download Options User Manual Documentation Type of Partnership