Add SECURITY.md for DataFusion by alamb · Pull Request #25917 · apache/datafusion

alamb · 2026-09-30T19:57:54Z

Which issue does this PR close?

Closes Add a security policy #25916.

Rationale for this change

As an ASF project, DataFusion should follow the ASF reporting guidelines and provide a means for responsible security disclosures.

What changes are included in this PR?

Adds a top-level SECURITY.md modeled on arrow-rs's SECURITY.md (and a similar update made in apache/datafusion-sqlparser-rs#2601). It describes:

The security model for DataFusion (what counts as a bug vs. a vulnerability)
How to report ordinary bugs (public issue tracker)
How to report vulnerabilities

It also adopts several ideas from DuckDB's excellent security policy. 🎩 🙏

What is the testing strategy for this PR?

CI

Are there any user-facing changes?

Adds a new SECURITY.md file at the repository root, visible on GitHub's repository page under 'Security'.

Closes apache#25916 Adds a security policy modeled on arrow-rs's SECURITY.md (https://github.com/apache/arrow-rs/blob/main/SECURITY.md), describing the security model and pointing reporters to the ASF security reporting process (https://www.apache.org/security/#reporting-a-vulnerability). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

alamb · 2026-09-30T20:55:03Z

 //! Substrait does not (yet) support the full range of plans and expressions
-//! that DataFusion offers. See the [datafusion-proto]  crate for a DataFusion
-//! specific format that does support of the full range.
+//! that DataFusion offers. See the [datafusion-proto] crate for a DataFusion


drive by cleanup

alamb · 2026-09-30T20:55:11Z

 //! # use datafusion_proto::bytes::Serializeable;
 //! # fn main() -> Result<()>{
-//! // Create a new `Expr` a < 32
+//! // Create a new `Expr` a < 5


alamb · 2026-09-30T20:55:50Z

+  under the License.
+-->
+
+# Security Policy


The goal of this file is to write down what I think have been implicit assumptions. But since they haven't been written down, I am not sure if everyone has the same assumptions

codecov-commenter · 2026-09-30T21:47:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.68%. Comparing base (bd86190) to head (4598b30).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #25917      +/-   ##
==========================================
- Coverage   82.69%   82.68%   -0.01%     
==========================================
  Files        1147     1147              
  Lines      447204   447204              
  Branches   447204   447204              
==========================================
- Hits       369793   369782      -11     
- Misses      55002    55010       +8     
- Partials    22409    22412       +3

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

phillipleblanc

Looks good to me, thanks Andrew!

martin-g

https://github.com/apache/datafusion/security/policy also states a Security Policy.
It looks like it loads its contents from .github/SECURITY.md but there is no such at https://github.com/apache/datafusion/tree/main/.github
I guess it inherited from https://github.com/apache org.
Maybe we should symlink this file to .github/SECURITY.md ?!

Co-authored-by: Martin Grigorov <martin-g@users.noreply.github.com>

alamb · 2026-10-01T13:08:35Z

Maybe we should symlink this file to .github/SECURITY.md ?

I agree if https://github.com/apache/datafusion/security/policy doesn't automatically update when we merge this PR in

jayzhan211

👍🏻

alamb · 2026-10-02T19:49:44Z

I'll plan to merge this on Monday Oct 5 unless anyone else would like time to review

samueleresca · 2026-10-04T14:04:33Z

Overall, looks good.

A minor note. My preference would be to explicitly state the configurations that contribute to security hardening and their default. For example, DuckDB does something similar. Some corresponding examples in the DataFusion domain:

SQLOptions and with_allow_ddl, with_allow_dml, with_allow_statements are all allowed by default, as already mentioned.
SessionContext::enable_url_table
No memory limits by default (e.g., UnboundedMemoryPool)

The stuff above might go in a dedicated section on the already existing Config page.

Other notes:

Worth stating that DataFusion relies on other OSS dependencies, and security reports affecting downstream dependencies should be opened in the corresponding repos?
Should the model state explicitly whether datafusion-cli is included or not in the model?

comphead

This is a good start, thanks @alamb

alamb · 2026-10-05T21:38:40Z

A minor note. My preference would be to explicitly state the configurations that contribute to security hardening and their default. For example, DuckDB does something similar. Some corresponding examples in the DataFusion domain:

Thank you @samueleresca - That is a good idea-- however I don't think it belongs in the security policy which should be the general purpose guidelines and policy. Indeed the doc you linked from DuckDB is actually an "operations manual" -- similar in spirit to our "library user's guide"

I will file a follow on issue to track adding such as "securing DataFusion" section

Update: filed

Add a "securing DataFusion" documentation #26061

alamb · 2026-10-05T21:42:15Z

Worth stating that DataFusion relies on other OSS dependencies, and security reports affecting downstream dependencies should be opened in the corresponding repos?

I think this is obvious, so I don't think it is worth a specific note here.

alamb · 2026-10-05T21:46:13Z

Should the model state explicitly whether datafusion-cli is included or not in the model?

Yes this is a great idea. Added in 4598b30. Thank you @samueleresca

alamb · 2026-10-05T21:52:57Z

Thank you everyone, I will merge this one and then we can iterate on it after that

martin-g · 2026-10-06T07:07:15Z

I agree if https://github.com/apache/datafusion/security/policy doesn't automatically update when we merge this PR in

https://github.com/apache/datafusion/security/policy is updated! Nothing else to do!

alamb and others added 2 commits September 30, 2026 15:57

hone

0a7c105

alamb changed the title ~~Add SECURITY.md following ASF guidelines~~ Add SECURITY.md Security Policy Sep 30, 2026

alamb added the documentation Improvements or additions to documentation label Sep 30, 2026

alamb added 6 commits September 30, 2026 16:18

Adapy from duckdb

0e20e71

rewrite

c56fa3c

rewrite

83d141a

trim

b51092c

notes in libs

d854347

cleanup

79aed46

github-actions Bot added substrait Changes to the substrait crate proto Related to proto crate and removed documentation Improvements or additions to documentation labels Sep 30, 2026

alamb commented Sep 30, 2026

View reviewed changes

alamb changed the title ~~Add SECURITY.md Security Policy~~ Add SECURITY.md for DataFusion Sep 30, 2026

alamb marked this pull request as ready for review September 30, 2026 20:56

phillipleblanc approved these changes Oct 1, 2026

View reviewed changes

martin-g approved these changes Oct 1, 2026

View reviewed changes

Comment thread SECURITY.md Outdated

alamb added the documentation Improvements or additions to documentation label Oct 1, 2026

Update SECURITY.md

5f6b5cd

Co-authored-by: Martin Grigorov <martin-g@users.noreply.github.com>

github-actions Bot removed the documentation Improvements or additions to documentation label Oct 1, 2026

timsaucer approved these changes Oct 1, 2026

View reviewed changes

adriangb approved these changes Oct 1, 2026

View reviewed changes

jayzhan211 approved these changes Oct 1, 2026

View reviewed changes

comphead approved these changes Oct 5, 2026

View reviewed changes

Merge remote-tracking branch 'apache/main' into security-policy

c475523

add note about datafusion-cli

4598b30

alamb enabled auto-merge October 5, 2026 21:46

alamb mentioned this pull request Oct 5, 2026

Add a "securing DataFusion" documentation #26061

Open

alamb added this pull request to the merge queue Oct 5, 2026

Merged via the queue into apache:main with commit b40d696 Oct 5, 2026
42 checks passed

alamb deleted the security-policy branch October 5, 2026 22:33

github-actions Bot added the v56.0.0 label Oct 5, 2026

Conversation

alamb commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Which issue does this PR close?

Rationale for this change

What changes are included in this PR?

What is the testing strategy for this PR?

Are there any user-facing changes?

Uh oh!

alamb Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

alamb Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

alamb Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

phillipleblanc left a comment

Choose a reason for hiding this comment

Uh oh!

martin-g left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alamb commented Oct 1, 2026

Uh oh!

jayzhan211 left a comment

Choose a reason for hiding this comment

Uh oh!

alamb commented Oct 2, 2026

Uh oh!

samueleresca commented Oct 4, 2026

Uh oh!

comphead left a comment

Choose a reason for hiding this comment

Uh oh!

alamb commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alamb commented Oct 5, 2026

Uh oh!

alamb commented Oct 5, 2026

Uh oh!

alamb commented Oct 5, 2026

Uh oh!

Uh oh!

martin-g commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

alamb commented Sep 30, 2026 •

edited

Loading

codecov-commenter commented Sep 30, 2026 •

edited

Loading

alamb commented Oct 5, 2026 •

edited

Loading