NVIDIA takes the security of our software products and services seriously, including the source code in this repository.

If you believe you have found a security vulnerability, please do not open a public GitHub issue. Use one of the private channels below.

We accept private reports through two channels. Either is acceptable; use whichever you prefer.

Open a private advisory from the Security tab of this repository, then Report a vulnerability. The advisory is only visible to repository maintainers and the reporter.

This is the preferred channel for vulnerabilities specific to the code in this repository.

For vulnerabilities that may affect multiple NVIDIA products, or if you prefer to use NVIDIA's coordinated disclosure process:

• Web: NVIDIA Security Vulnerability Submission Form
• Email: psirt@nvidia.com
  • PGP key: https://www.nvidia.com/en-us/security/pgp-key

Please include in your report:

• Product name and the version, branch, or commit SHA that contains the vulnerability
• Vulnerability class (for example: remote code execution, denial of service, privilege escalation, information disclosure)
• Reproduction steps
• Proof-of-concept code or exploit, if available
• Your assessment of the potential impact

• Acknowledgement: within 3 business days of your report
• Initial assessment: within 10 business days
• Status updates: at least every 14 days while the issue is open

We will coordinate a public disclosure timeline with you once a fix is available.

NVIDIA does not currently run a paid bug bounty program for this repository. We do publicly acknowledge externally reported security issues that are addressed under our coordinated disclosure policy, where the reporter wishes to be named.