DOCS / REFERENCE / SECURITY

Security

Supported versions, how to report a vulnerability, and how to handle CDK tokens safely in your own pipelines.

Supported versions

1.xSupported
< 1.0 (pre-release)Unsupported

Reporting a vulnerability

Email [email protected] with details. We'll acknowledge within 2 business days and aim to share a fix timeline within 5.

Please don't open a public issue for suspected vulnerabilities before we've had a chance to respond.

Safe Harbor

Security research conducted in good faith — without accessing, modifying, or exfiltrating data beyond what's needed to demonstrate an issue — won't result in legal action from CDK.

Best practices for integrators

  • Scope tokens minimally. Create separate tokens per pipeline or environment rather than one broad token used everywhere.
  • Rotate regularly. Especially for long-lived integrations like Jenkins, where tokens are stored rather than issued fresh per run.
  • Never commit tokens to source control. Use your CI platform's secret store — see the integration guides for GitHub Actions, GitLab CI, and Jenkins.
  • Verify independently sometimes. Don't rely solely on CDK's dashboard — the point of the evidence model is that anyone can check a signature without trusting CDK's UI.

Learn more

Security Architecture — the cryptographic design→ Threat Model — what CDK protects against→ Enterprise Security — CDK's own vendor posture→
← All Docs Request Enterprise Access