pg-java is pre-release. Nothing has been published to Maven Central and there are no released versions to patch, so please report against the current main branch. Once releases begin, this section will name the supported lines.

Do not open a public issue for a security report.

Use GitHub's private vulnerability reporting on this repository: the Security tab, then Report a vulnerability. That creates a private advisory visible only to the maintainers, and it is the preferred channel because the discussion, the fix, and the eventual advisory all stay in one place.

We will acknowledge your report and keep you updated as we confirm it, prepare a fix, and decide on disclosure. Please give us a reasonable window to ship a fix before disclosing publicly.

A report is much faster to act on with:

• The PostgreSQL server version, and the server's authentication method (scram-sha-256, md5, cert, ...) if authentication or TLS is involved.
• The pg-java commit you tested against.
• The connection string or PgConnectionConfig, with the password removed.
• A minimal reproduction: a test case is ideal, and MockServer (see docs/adr/ADR-0003-testing-strategy.md) can drive most protocol-level behavior with no server or Docker.
• What you expected to happen and what happened instead.

Some of the driver's security-relevant defaults are documented decisions rather than open findings. Please read these before reporting, so a settled trade-off is not re-reported as a vulnerability:

• docs/adr/ADR-0009-tls-and-transport-security.md -- TLS posture, including why sslmode defaults to prefer for libpq parity, and what the driver does instead: it refuses to send a cleartext or md5 credential over an unencrypted channel.
• docs/adr/ADR-0010-secret-handling-boundary.md -- how secrets are held, cleared, and kept out of logs and exception messages.
• docs/reviews/security-default-decisions-2026-07.md -- the reasoning behind each of those defaults, with the alternatives that were rejected and why.
• docs/reviews/repo-audit-2026-07.md -- the 2026-07 security audit, its findings, and the commits that closed them.

If you believe one of those decisions is wrong, that is a worthwhile discussion and a public issue is the right venue. A concrete exploit against one of them is a security report, and belongs in a private advisory.

• Vulnerabilities in PostgreSQL itself. Report those to the PostgreSQL project: https://www.postgresql.org/support/security/.
• Vulnerabilities in build-time or test-only dependencies that do not ship, and in the build-only modules (postgresql-client-bench, postgresql-client-bench-jmh, postgresql-client-coverage, postgresql-client-native-smoke, compat-suites/).
• Reports that require an attacker who already controls the application's configuration or the JVM it runs in.