# Security Announcements

## Receiving Security Advisories

The best way to receive any and all security announcements is to subscribe to the [Apache Announce Mailing List](https://lists.apache.org/list.html?announce@apache.org).

This mailing list has a reasonable level of traffic, and receives notifications only after security reports have been managed by the core Apache teams and fixes are publicly available.

This mailing list also has announcements of releases for Apache projects.

## Reporting Vulnerabilities

We strongly encourage people to report such problems to our private security mailing list first, before disclosing them in a public forum.

Please follow the [guidelines](https://www.apache.org/security/) laid down by the Apache Security team.

Ideally, any issues affecting Apache Pekko and its predecessor project should be reported to the Apache Pekko team
first. We will coordinate responsible disclosure with the affected upstream maintainers when needed.

## Security Related Documentation

 * [Apache Pekko security announcements](https://pekko.apache.org/docs/pekko/current/security/)
 * @ref:[Java Serialization](../serialization.md#java-serialization)
 * @ref:[Remote deployment allow list](../remoting.md#remote-deployment-allow-list)
 * @ref:[Remote Security](../remote-security.md)
