Scala Security Policy

Receiving Security Announcements

Security announcements related to Scala are published to the “Security Announcements” channel on our discourse forum.

Messages to this channel can only be posted by administrators, so it is very low traffic. To set up email notifications for new security announcements, read this post.

Reporting Vulnerabilities

We strongly encourage reporting security issues in Scala to us privately before disclosing them in public.

The email address for security related communication is security@scala-lang.org. Messages are delivered to the Scala Security Team, which includes people from EPFL, the Scala Center, VirtusLab, and Akka.

We strive to acknowledge reports within 2 business days. In case you don’t receive a reply within a few days and would like to escalate, our advice is to ask for a contact person in a forum hosted by the Scala organization:

• Meta category on Discourse
• #admin channel on Discord (invite link for joining)