There are a number of avenues for reporting security issues to the Jetty project available. If the issue is directly related to Jetty itself then reporting to the Jetty developers is encouraged. The most direct method is to mail [email protected]. Since Webtide is comprised of the active committers of the Jetty project this is our preferred reporting method. We are generally flexible in how we work with reporters of security issues but we reserve the right to act in the interests of the Jetty project in all circumstances.

If the issue is related to Eclipse or its Jetty integration then we encourage you to reach out to [email protected].

If the issue is related to integrations with Jetty we are happy to work with you to identify the proper entity and either of the approaches above is fine.

We prefer that security issues are reported directly to Jetty developers as opposed through GitHub Issues since it has no facility to tag issues as private.