Apache OpenDAL Reqsign follows the Apache Software Foundation security process. Please report suspected vulnerabilities privately to private@opendal.apache.org. If you are unsure where to send the report, use the ASF Security Team address, security@apache.org. Do not open public GitHub issues or pull requests for security reports.

When reporting, include:

• the affected crate name and version;
• the affected signing service, such as AWS SigV4, Azure Storage, Google, Aliyun OSS, Huawei Cloud OBS, Oracle Cloud, Tencent COS, Volcengine TOS, or another supported service;
• whether the issue affects direct reqsign use, Apache OpenDAL integration, or another embedding application;
• a minimal reproduction, affected request, credential-provider configuration, and expected versus actual behavior;
• whether credentials, bearer tokens, private keys, signed URLs, logs, or debug output were exposed.

The security boundary, in-scope findings, out-of-scope deployment issues, and triage guidance for this repository are documented in THREAT_MODEL.md.

Apache OpenDAL is Reqsign's primary integration for custom key signing and cloud-provider authentication, but Reqsign can also be embedded directly by other applications. OpenDAL-specific storage behavior, operator authorization, path policy, and storage-service trust boundaries are covered by OpenDAL's own security documentation.