# Vulnerability Scanning

Separate weekly workflows build development images from the `main` branches of the API7 Gateway and Control Plane repositories and scan them for vulnerabilities. The Control Plane workflow scans `api7-ee-3-integrated`, `api7-ee-dp-manager`, and `api7-ee-file-server`; the Gateway workflow scans `api7-ee-3-gateway`. Fixable high- and critical-severity findings open tracking issues for assessment and remediation.

## Automated Image Scanning[​](#automated-image-scanning "Direct link to Automated Image Scanning")

These scheduled scans support monitoring and triage. They do not block releases or guarantee that every released image was scanned before signing. For the component and license inventory included in API7 Gateway, see [open-source licenses](https://docs.api7.ai/api7-gateway/security-and-compliance/open-source-licenses.md).

## CVE Reporting and Patching[​](#cve-reporting-and-patching "Direct link to CVE Reporting and Patching")

When a vulnerability is identified, API7.ai follows a structured response process:

1. **Assessment**: The security team evaluates the severity and impact of the vulnerability.
2. **Patching**: We develop and test a security patch to address the vulnerability.
3. **Release**: The patch is released as part of a security update or included in the next version release.
4. **Advisory**: A security advisory notifies affected customers and provides guidance on applying the fix.

## Vulnerability disclosure policy[​](#vulnerability-disclosure-policy "Direct link to Vulnerability disclosure policy")

We welcome reports from independent security researchers and our community. If you believe you have found a security vulnerability in API7 Gateway, please email <security@api7.ai> with a detailed description, reproduction steps, and any supporting evidence. Our security team will acknowledge your report and work with you on coordinated disclosure. For general inquiries about our security program or to request additional disclosure channels, contact your API7 support representative.

## Third-Party Audits[​](#third-party-audits "Direct link to Third-Party Audits")

API7 Gateway undergoes periodic security audits by third-party security firms. These audits provide an independent assessment of the product's security posture.

## Next Steps[​](#next-steps "Direct link to Next Steps")

* [Verify Image Signatures](https://docs.api7.ai/api7-gateway/security-and-compliance/verify-image-signatures.md) to confirm that you are running an official signed image.
* [Review our Trust Center](https://docs.api7.ai/api7-gateway/security-and-compliance/trust-center.md) for certifications and security reports.