The Apache Software Foundation (ASF) and the Apache Wayang community take security very seriously. Apache Wayang specifically provides robust security features and actively addresses concerns around potential vulnerabilities. If you have discovered a vulnerability or have concerns regarding Apache Wayang security, please immediately contact the security team via email at security@wayang.apache.org.

In your email, please include:

• A detailed description of the security issue
• Steps to reproduce the vulnerability, if possible

Upon receiving your report, our security team will review the provided information and respond accordingly.

Please reserve the security address exclusively for reporting undisclosed vulnerabilities. For general security-related questions, usage of security features, or addressing known fixed issues, please utilize our user and developer mailing lists instead. Do not publicly disclose vulnerabilities without first reporting them to the Apache Wayang security team.

The ASF Security team maintains detailed guidelines on managing and addressing vulnerabilities. For further information, please refer to the ASF Security Page.

Many organizations employ security scanning tools to identify components with known security advisories. Although we strongly recommend these tools as they can alert users to potential risks, they often generate false positives. This occurs because a vulnerable dependency may not necessarily impact Apache Wayang if used in a non-exploitable manner.

Therefore, advisories regarding Apache Wayang's dependencies are not automatically considered critical. However, if additional analysis indicates that Apache Wayang might be affected by a dependency's vulnerability, please report your findings privately to security@wayang.apache.org.

If a dependency advisory is identified, please:

1. Verify if our DependencyCheck suppressions contain relevant details.
2. Check our issue tracker for discussions regarding this advisory.
3. Conduct your own analysis to determine whether Apache Wayang is affected.
   • If affected, report your findings privately through security@wayang.apache.org.
   • If not affected, please contribute by updating the DependencyCheck suppression list, clearly documenting why Apache Wayang is not impacted.

The wayang-api-json module exposes a REST endpoint that accepts a WayangPlan in JSON format, including UDFs to be executed by the targeted engine. This endpoint has no built-in authentication or authorization — any client that can reach it can submit UDFs that will execute with the privileges of the Wayang process.

This is a deliberate scope decision: the module is intended for use on a trusted network only (localhost, a private subnet, or behind a VPN). If the endpoint is exposed on a public IP, an authentication and encryption layer is recommended.

Questions on this are welcome at security@wayang.apache.org.