We take all security reports seriously. When we receive such reports, we will investigate and subsequently address any potential vulnerabilities as quickly as possible.

Please do not create a public GitHub issue in this project. If you discover a potential security issue, notify AWS/Amazon Security via our vulnerability reporting page or directly via email to AWS Security. If you prefer to encrypt your report, use the AWS PGP public key.

Please do not include sensitive information — credentials, private keys, customer data, or personally identifiable information — in your report.

We will keep you updated while we investigate, and we ask that you not disclose the issue publicly until a fix has shipped.

Thank you for collaborating with us to help protect our customers.