Skip to main content
API7.ai Logo
Version: 3.9.x

Vulnerability Scanning

Separate weekly workflows build development images from the main branches of the API7 Gateway and Control Plane repositories and scan them for vulnerabilities. The Control Plane workflow scans api7-ee-3-integrated, api7-ee-dp-manager, and api7-ee-file-server; the Gateway workflow scans api7-ee-3-gateway. Fixable high- and critical-severity findings open tracking issues for assessment and remediation.

Automated Image Scanning​

These scheduled scans support monitoring and triage. They do not block releases or guarantee that every released image was scanned before signing. For the component and license inventory included in API7 Gateway, see open-source licenses.

CVE Reporting and Patching​

When a vulnerability is identified, API7.ai follows a structured response process:

  1. Assessment: The security team evaluates the severity and impact of the vulnerability.
  2. Patching: We develop and test a security patch to address the vulnerability.
  3. Release: The patch is released as part of a security update or included in the next version release.
  4. Advisory: A security advisory notifies affected customers and provides guidance on applying the fix.

Vulnerability disclosure policy​

We welcome reports from independent security researchers and our community. If you believe you have found a security vulnerability in API7 Gateway, please email security@api7.ai with a detailed description, reproduction steps, and any supporting evidence. Our security team will acknowledge your report and work with you on coordinated disclosure. For general inquiries about our security program or to request additional disclosure channels, contact your API7 support representative.

Third-Party Audits​

API7 Gateway undergoes periodic security audits by third-party security firms. These audits provide an independent assessment of the product's security posture.

Next Steps​