From 5b858f5e7009dcee4ad91deda18fff78485589e3 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Fri, 2 Oct 2026 22:20:51 +0000 Subject: [PATCH 1/7] docs: Add SECURITY.md TRI-1935 --- SECURITY.md | 155 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..bc3853d0 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,155 @@ + + +# Security Policy + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues, +discussions, or pull requests.** + +To report a potential security vulnerability in this project or any other +NVIDIA product, use one of the following channels: + +1. **NVIDIA Vulnerability Disclosure Program (preferred):** + [https://www.nvidia.com/en-us/security/](https://www.nvidia.com/en-us/security/) +2. **Email:** [psirt@nvidia.com](mailto:psirt@nvidia.com). Please encrypt + sensitive reports with NVIDIA's + [PGP key](https://www.nvidia.com/en-us/security/pgp-key). +3. **GitHub Private Vulnerability Reporting:** use the **Security** tab of this + repository and select **Report a vulnerability**. + +**OEM partners should contact their NVIDIA Customer Program Manager.** + +Please include as much of the following as you can: + +1. Product name and version or branch (for example the container tag or the + `tensorrtllm_backend` / TensorRT-LLM release) that contains the issue +2. Type of vulnerability (for example code execution, denial of service, + memory corruption, information disclosure) +3. Step-by-step instructions to reproduce the issue +4. Proof-of-concept or exploit code, if available +5. Potential impact, including how an attacker could exploit it + +NVIDIA PSIRT acknowledges reports, assesses severity, coordinates a fix and +disclosure timeline with the reporter, and publishes security bulletins at +[https://www.nvidia.com/en-us/security/](https://www.nvidia.com/en-us/security/). + +## Security Architecture & Context + +**Project:** `tensorrtllm_backend` provides the Triton Inference Server +backend, ensemble/BLS model templates, documentation, and container +build recipe for serving [TensorRT-LLM](https://github.com/NVIDIA/TensorRT-LLM) +engines with in-flight batching. + +**Software classification:** Library / Service component. This repository +contains no executable service logic of its own: the C++ backend, Python +pre/post-processing models, launch scripts, and example clients live in the +`tensorrt_llm` git submodule (TensorRT-LLM) and are copied into the image by +`dockerfile/Dockerfile.triton.trt_llm_backend`. The backend runs inside +`tritonserver` and is exposed through Triton's HTTP/REST, gRPC, and metrics +endpoints. + +**Primary security responsibility:** Faithfully load operator-supplied TensorRT +engines, tokenizers, and LoRA adapters; execute inference requests without +corrupting memory or leaking data between requests; and coordinate multi-GPU +and multi-node execution without exposing the coordination channel. + +**Key security boundaries and interfaces:** + +- Triton inference APIs (HTTP/REST, gRPC) carry untrusted request inputs such + as `text_input`, `input_ids`, `lora_weights`, `lora_config`, and + `guided_decoding_guide`. +- The model repository on disk (engines, `config.pbtxt`, tokenizer files, and + Python model scripts) is read at load time. +- MPI (leader mode and orchestrator mode, `launch_triton_server.py`) links + Triton processes across GPUs and nodes. +- The container build downloads TensorRT, PyTorch components, and + TensorRT-LLM from NVIDIA-controlled sources. + +**Repository Exposure Classification:** Public. Basis: the repository is +published on GitHub with public visibility. + +**Service Exposure Classification:** Internal-Sensitive (confidence: medium). +Basis: the backend is normally deployed behind an operator's own network +controls, serves model inputs and outputs that may contain sensitive +user data, and does not itself provide authentication. This classification is +an assessment aid and not an official NVIDIA label. + +## Threat Model + +1. **Malicious or malformed inference inputs:** Crafted tensors sent to the + `tensorrt_llm` model, such as oversized or inconsistent `input_ids`, + `lora_weights`/`lora_config` shapes, or invalid `guided_decoding_guide` + grammars (JSON schema, regex, EBNF), could trigger crashes, excessive + resource use, or memory errors in the backend and in the TensorRT-LLM + executor it wraps. +2. **Untrusted model artifacts:** Engines, tokenizer files, LoRA weights, and + the Python model scripts in a model repository are loaded and executed with + the privileges of the Triton process. A tampered or untrusted model + repository, or a tokenizer or adapter fetched from a public hub, can lead + to code execution or data disclosure. +3. **Unauthenticated MPI coordination channel:** In leader and orchestrator + mode, Triton ranks communicate over MPI. A network-adjacent attacker, or a + co-tenant on the same node or cluster, who can reach that channel could + interfere with or observe inter-rank traffic. +4. **Supply-chain compromise at build time:** The Dockerfile downloads the + TensorRT tarball over HTTPS, installs Python wheels from public and NVIDIA + package indexes, runs an installer script fetched from a branch URL, and + clones TensorRT-LLM by tag. A compromised upstream, mutable reference, or + package confusion could introduce malicious code into the image. +5. **Cross-request information disclosure:** Features that share state across + requests, such as the LoRA cache keyed by `lora_task_id`, KV-cache reuse, + and returned logits and performance metrics, could expose one tenant's + data or adapters to another if deployed in a shared, multi-tenant setting. +6. **Resource exhaustion (denial of service):** Large batches, long + sequences, streaming requests, and many LoRA adapters can exhaust GPU + memory, host memory, or request queues, and a failure of a single MPI rank + can stall the whole deployment. + +## Critical Security Assumptions + +- **Authentication and authorization are external.** Neither this repository + nor the backend authenticates clients; operators must place Triton behind + an authenticated, TLS-terminating gateway or a trusted network. +- **The model repository is trusted.** Engines, tokenizers, adapters, and + Python model code are assumed to come from a trusted source and to be + integrity-checked by the operator before being loaded. +- **The MPI fabric is private.** Inter-process and inter-node communication + is assumed to run on an isolated, trusted network with no untrusted peers. +- **Inputs are validated upstream where limits matter.** Request size, + sequence length, and rate limits are assumed to be enforced by Triton + configuration or a front-end proxy. +- **The deployment is single-tenant, or tenants are isolated.** Shared caches + and adapters are assumed not to cross trust boundaries. +- **Upstream components are trusted.** Triton Server, TensorRT, + TensorRT-LLM, PyTorch, CUDA, and the base container images are assumed to + be free of vulnerabilities in the pinned versions; consult the + corresponding projects for their own security policies and advisories. +- **Build inputs are reviewed.** Operators building the image are expected to + review and, where required, pin build arguments and download sources. From 83db26030902dd28e0b33b074a046292ef7ade18 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 17:12:20 +0000 Subject: [PATCH 2/7] docs: Address SECURITY.md review findings TRI-1935 --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index bc3853d0..d7d5519f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -41,7 +41,7 @@ NVIDIA product, use one of the following channels: 2. **Email:** [psirt@nvidia.com](mailto:psirt@nvidia.com). Please encrypt sensitive reports with NVIDIA's [PGP key](https://www.nvidia.com/en-us/security/pgp-key). -3. **GitHub Private Vulnerability Reporting:** use the **Security** tab of this +3. **GitHub Private Vulnerability Reporting (where enabled):** use the **Security** tab of this repository and select **Report a vulnerability**. **OEM partners should contact their NVIDIA Customer Program Manager.** From b3eaf5938b7acdeeb7a380e00e15f63fa3f9e86a Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 18:04:03 +0000 Subject: [PATCH 3/7] docs: Address Greptile review on SECURITY.md TRI-1935 --- SECURITY.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index d7d5519f..6dc9a1cc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -70,8 +70,12 @@ engines with in-flight batching. **Software classification:** Library / Service component. This repository contains no executable service logic of its own: the C++ backend, Python pre/post-processing models, launch scripts, and example clients live in the -`tensorrt_llm` git submodule (TensorRT-LLM) and are copied into the image by -`dockerfile/Dockerfile.triton.trt_llm_backend`. The backend runs inside +TensorRT-LLM project and are copied into the image by +`dockerfile/Dockerfile.triton.trt_llm_backend`. That Dockerfile does not use this +repository's `tensorrt_llm` submodule: it clones `TENSORRTLLM_REPO` (default +`NVIDIA/TensorRT-LLM`) at `TENSORRTLLM_REPO_TAG`, copies the scripts, models, +client, tools and examples from that clone, and installs the `tensorrt_llm` +wheel separately (`TENSORRTLLM_VER`). The backend runs inside `tritonserver` and is exposed through Triton's HTTP/REST, gRPC, and metrics endpoints. @@ -121,7 +125,8 @@ an assessment aid and not an official NVIDIA label. 4. **Supply-chain compromise at build time:** The Dockerfile downloads the TensorRT tarball over HTTPS, installs Python wheels from public and NVIDIA package indexes, runs an installer script fetched from a branch URL, and - clones TensorRT-LLM by tag. A compromised upstream, mutable reference, or + clones TensorRT-LLM at `release/1.2.1` by default, which is a release branch + that can move, not a fixed tag. A compromised upstream, mutable reference, or package confusion could introduce malicious code into the image. 5. **Cross-request information disclosure:** Features that share state across requests, such as the LoRA cache keyed by `lora_task_id`, KV-cache reuse, From 4cf062c474781dd6fc3c8fb3a580f497145917db Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 19:31:12 +0000 Subject: [PATCH 4/7] docs: Simplify SECURITY.md TRI-1935 --- SECURITY.md | 164 ++++++++++++++-------------------------------------- 1 file changed, 42 insertions(+), 122 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 6dc9a1cc..8db20123 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -30,131 +30,51 @@ ## Reporting a Vulnerability -**Please do not report security vulnerabilities through public GitHub issues, -discussions, or pull requests.** - -To report a potential security vulnerability in this project or any other -NVIDIA product, use one of the following channels: - -1. **NVIDIA Vulnerability Disclosure Program (preferred):** - [https://www.nvidia.com/en-us/security/](https://www.nvidia.com/en-us/security/) -2. **Email:** [psirt@nvidia.com](mailto:psirt@nvidia.com). Please encrypt - sensitive reports with NVIDIA's - [PGP key](https://www.nvidia.com/en-us/security/pgp-key). -3. **GitHub Private Vulnerability Reporting (where enabled):** use the **Security** tab of this - repository and select **Report a vulnerability**. - -**OEM partners should contact their NVIDIA Customer Program Manager.** - -Please include as much of the following as you can: - -1. Product name and version or branch (for example the container tag or the - `tensorrtllm_backend` / TensorRT-LLM release) that contains the issue -2. Type of vulnerability (for example code execution, denial of service, - memory corruption, information disclosure) -3. Step-by-step instructions to reproduce the issue -4. Proof-of-concept or exploit code, if available -5. Potential impact, including how an attacker could exploit it - -NVIDIA PSIRT acknowledges reports, assesses severity, coordinates a fix and -disclosure timeline with the reporter, and publishes security bulletins at -[https://www.nvidia.com/en-us/security/](https://www.nvidia.com/en-us/security/). - -## Security Architecture & Context - -**Project:** `tensorrtllm_backend` provides the Triton Inference Server -backend, ensemble/BLS model templates, documentation, and container -build recipe for serving [TensorRT-LLM](https://github.com/NVIDIA/TensorRT-LLM) -engines with in-flight batching. - -**Software classification:** Library / Service component. This repository -contains no executable service logic of its own: the C++ backend, Python -pre/post-processing models, launch scripts, and example clients live in the -TensorRT-LLM project and are copied into the image by -`dockerfile/Dockerfile.triton.trt_llm_backend`. That Dockerfile does not use this -repository's `tensorrt_llm` submodule: it clones `TENSORRTLLM_REPO` (default -`NVIDIA/TensorRT-LLM`) at `TENSORRTLLM_REPO_TAG`, copies the scripts, models, -client, tools and examples from that clone, and installs the `tensorrt_llm` -wheel separately (`TENSORRTLLM_VER`). The backend runs inside -`tritonserver` and is exposed through Triton's HTTP/REST, gRPC, and metrics -endpoints. - -**Primary security responsibility:** Faithfully load operator-supplied TensorRT -engines, tokenizers, and LoRA adapters; execute inference requests without -corrupting memory or leaking data between requests; and coordinate multi-GPU -and multi-node execution without exposing the coordination channel. - -**Key security boundaries and interfaces:** - -- Triton inference APIs (HTTP/REST, gRPC) carry untrusted request inputs such - as `text_input`, `input_ids`, `lora_weights`, `lora_config`, and - `guided_decoding_guide`. -- The model repository on disk (engines, `config.pbtxt`, tokenizer files, and - Python model scripts) is read at load time. -- MPI (leader mode and orchestrator mode, `launch_triton_server.py`) links - Triton processes across GPUs and nodes. -- The container build downloads TensorRT, PyTorch components, and - TensorRT-LLM from NVIDIA-controlled sources. - -**Repository Exposure Classification:** Public. Basis: the repository is -published on GitHub with public visibility. - -**Service Exposure Classification:** Internal-Sensitive (confidence: medium). -Basis: the backend is normally deployed behind an operator's own network -controls, serves model inputs and outputs that may contain sensitive -user data, and does not itself provide authentication. This classification is -an assessment aid and not an official NVIDIA label. +NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. + +To report a potential security vulnerability, please use one of the following channels: + +1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ +2. **Web form:** [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) +3. **Email:** [NVIDIA PSIRT](mailto:psirt@nvidia.com). Please encrypt sensitive reports with NVIDIA's [PGP key](https://www.nvidia.com/en-us/security/pgp-key). +4. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. + +**Do not open a public issue or pull request to report a vulnerability.** + +Please include: + +* Product or component name and version or branch +* Type of vulnerability +* Steps to reproduce +* Proof of concept, if available +* Potential impact and how it could be exploited + +See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. + +## Security Architecture and Context + +**Project:** The Triton TensorRT-LLM Backend. + +**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. + +**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. + +**Repository Exposure Classification:** Public. + +**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. ## Threat Model -1. **Malicious or malformed inference inputs:** Crafted tensors sent to the - `tensorrt_llm` model, such as oversized or inconsistent `input_ids`, - `lora_weights`/`lora_config` shapes, or invalid `guided_decoding_guide` - grammars (JSON schema, regex, EBNF), could trigger crashes, excessive - resource use, or memory errors in the backend and in the TensorRT-LLM - executor it wraps. -2. **Untrusted model artifacts:** Engines, tokenizer files, LoRA weights, and - the Python model scripts in a model repository are loaded and executed with - the privileges of the Triton process. A tampered or untrusted model - repository, or a tokenizer or adapter fetched from a public hub, can lead - to code execution or data disclosure. -3. **Unauthenticated MPI coordination channel:** In leader and orchestrator - mode, Triton ranks communicate over MPI. A network-adjacent attacker, or a - co-tenant on the same node or cluster, who can reach that channel could - interfere with or observe inter-rank traffic. -4. **Supply-chain compromise at build time:** The Dockerfile downloads the - TensorRT tarball over HTTPS, installs Python wheels from public and NVIDIA - package indexes, runs an installer script fetched from a branch URL, and - clones TensorRT-LLM at `release/1.2.1` by default, which is a release branch - that can move, not a fixed tag. A compromised upstream, mutable reference, or - package confusion could introduce malicious code into the image. -5. **Cross-request information disclosure:** Features that share state across - requests, such as the LoRA cache keyed by `lora_task_id`, KV-cache reuse, - and returned logits and performance metrics, could expose one tenant's - data or adapters to another if deployed in a shared, multi-tenant setting. -6. **Resource exhaustion (denial of service):** Large batches, long - sequences, streaming requests, and many LoRA adapters can exhaust GPU - memory, host memory, or request queues, and a failure of a single MPI rank - can stall the whole deployment. +1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. +2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. +3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. +4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. +5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. ## Critical Security Assumptions -- **Authentication and authorization are external.** Neither this repository - nor the backend authenticates clients; operators must place Triton behind - an authenticated, TLS-terminating gateway or a trusted network. -- **The model repository is trusted.** Engines, tokenizers, adapters, and - Python model code are assumed to come from a trusted source and to be - integrity-checked by the operator before being loaded. -- **The MPI fabric is private.** Inter-process and inter-node communication - is assumed to run on an isolated, trusted network with no untrusted peers. -- **Inputs are validated upstream where limits matter.** Request size, - sequence length, and rate limits are assumed to be enforced by Triton - configuration or a front-end proxy. -- **The deployment is single-tenant, or tenants are isolated.** Shared caches - and adapters are assumed not to cross trust boundaries. -- **Upstream components are trusted.** Triton Server, TensorRT, - TensorRT-LLM, PyTorch, CUDA, and the base container images are assumed to - be free of vulnerabilities in the pinned versions; consult the - corresponding projects for their own security policies and advisories. -- **Build inputs are reviewed.** Operators building the image are expected to - review and, where required, pin build arguments and download sources. +* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. +* Models, configuration and other inputs come from trusted sources. +* Dependencies and the build environment are kept up to date and obtained from trusted sources. +* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. +* Host operating system, driver and hardware security are the operator's responsibility. From 1de8b18315e3b5167b493451149607e971c670f5 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 20:24:48 +0000 Subject: [PATCH 5/7] docs: Use standard NVIDIA SECURITY.md TRI-1935 --- SECURITY.md | 58 ++++++++++------------------------------------------- 1 file changed, 11 insertions(+), 47 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 8db20123..df209802 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,55 +26,19 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> -# Security Policy +# Report a Security Vulnerability -## Reporting a Vulnerability +To report a potential security vulnerability in any NVIDIA product, please use either: +* This web form: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html), or +* Send email to: [NVIDIA PSIRT](mailto:psirt@nvidia.com) -NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. +**OEM Partners should contact their NVIDIA Customer Program Manager** -To report a potential security vulnerability, please use one of the following channels: - -1. **NVIDIA Vulnerability Disclosure Program** (preferred): https://www.nvidia.com/en-us/security/ -2. **Web form:** [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) -3. **Email:** [NVIDIA PSIRT](mailto:psirt@nvidia.com). Please encrypt sensitive reports with NVIDIA's [PGP key](https://www.nvidia.com/en-us/security/pgp-key). -4. **GitHub Private Vulnerability Reporting (where enabled):** use the "Report a vulnerability" button on the Security tab of this repository. - -**Do not open a public issue or pull request to report a vulnerability.** - -Please include: - -* Product or component name and version or branch -* Type of vulnerability -* Steps to reproduce -* Proof of concept, if available -* Potential impact and how it could be exploited +If reporting a potential vulnerability via email, please encrypt it using NVIDIA’s public PGP key ([see PGP Key page](https://www.nvidia.com/en-us/security/pgp-key/)) and include the following information: +1. Product/Driver name and version/branch that contains the vulnerability +2. Type of vulnerability (code execution, denial of service, buffer overflow, etc.) +3. Instructions to reproduce the vulnerability +4. Proof-of-concept or exploit code +5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. - -## Security Architecture and Context - -**Project:** The Triton TensorRT-LLM Backend. - -**Software type:** Software component (library, backend, client or tool) used as part of a Triton Inference Server deployment. - -**Security boundaries:** The main security boundary is between this component and the data, models and configuration it is given, and between it and the server or application that hosts it. - -**Repository Exposure Classification:** Public. - -**Service Exposure Classification:** Deployment-dependent. Exposure depends on how the software is deployed and configured by the operator. - -## Threat Model - -1. **Untrusted input:** Requests, models, configuration or data supplied to this component may be malformed or malicious, and could cause crashes, memory errors or unintended behavior if not validated. -2. **Supply chain:** Source and build dependencies fetched at build or install time may be compromised, outdated or unpinned. -3. **Network exposure:** When deployed behind a network-facing server, endpoints may be reachable by untrusted clients. This component does not by itself provide authentication, authorization or encryption. -4. **Resource exhaustion:** Oversized or numerous requests may consume memory, compute or other resources and degrade availability. -5. **Information disclosure:** Logs, metrics and error messages may reveal sensitive data such as paths, identifiers or request content. - -## Critical Security Assumptions - -* The component is deployed in a trusted environment or behind a gateway that provides authentication, authorization, TLS and rate limiting. -* Models, configuration and other inputs come from trusted sources. -* Dependencies and the build environment are kept up to date and obtained from trusted sources. -* Operators protect secrets, certificates and credentials, and restrict access to logs and metrics. -* Host operating system, driver and hardware security are the operator's responsibility. From e9739ccd6858b73f65b6052c98a64c95fc289846 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 21:13:28 +0000 Subject: [PATCH 6/7] docs: Add vulnerability reporting guidance to SECURITY.md TRI-1935 --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index df209802..b600f85a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -42,3 +42,5 @@ If reporting a potential vulnerability via email, please encrypt it using NVIDIA 5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. + +**Please do not report security vulnerabilities through public issues or other public channels.** From 558364764c450988816f751f678de484f9956fb4 Mon Sep 17 00:00:00 2001 From: "M. Chornyi" <99709299+mc-nv@users.noreply.github.com> Date: Mon, 5 Oct 2026 21:36:27 +0000 Subject: [PATCH 7/7] docs: Adopt current NVIDIA SECURITY.md template TRI-1935 --- SECURITY.md | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b600f85a..0f8d3b0e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,21 +26,28 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> -# Report a Security Vulnerability +## Security -To report a potential security vulnerability in any NVIDIA product, please use either: -* This web form: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html), or -* Send email to: [NVIDIA PSIRT](mailto:psirt@nvidia.com) +NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization. -**OEM Partners should contact their NVIDIA Customer Program Manager** +If you need to report a security issue, please use the appropriate contact points outlined below. **Please do not report security vulnerabilities through GitHub/GitLab.** If a potential security issue is inadvertently reported via a public issue or pull request, NVIDIA maintainers may limit public discussion and redirect the reporter to the appropriate private disclosure channels. -If reporting a potential vulnerability via email, please encrypt it using NVIDIA’s public PGP key ([see PGP Key page](https://www.nvidia.com/en-us/security/pgp-key/)) and include the following information: -1. Product/Driver name and version/branch that contains the vulnerability -2. Type of vulnerability (code execution, denial of service, buffer overflow, etc.) -3. Instructions to reproduce the vulnerability -4. Proof-of-concept or exploit code -5. Potential impact of the vulnerability, including how an attacker could exploit the vulnerability +## Reporting Potential Security Vulnerability in an NVIDIA Product -See https://www.nvidia.com/en-us/security/ for past NVIDIA Security Bulletins and Notices. +To report a potential security vulnerability in any NVIDIA product: -**Please do not report security vulnerabilities through public issues or other public channels.** +- Web: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html) +- E-Mail: psirt@nvidia.com + - We encourage you to use the following PGP key for secure email communication: [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key) + - Please include the following information: + - Product/Driver name and version/branch that contains the vulnerability + - Type of vulnerability (code execution, denial of service, buffer overflow, etc.) + - Instructions to reproduce the vulnerability + - Proof-of-concept or exploit code + - Potential impact of the vulnerability, including how an attacker could exploit the vulnerability + +While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy. Please visit our [Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/) policies page for more information. + +## NVIDIA Product Security + +For all security-related concerns, please visit NVIDIA's Product Security portal at https://www.nvidia.com/en-us/security