I noticed that my report regarding a potential DoS bug in the instant Elasticsearch deployment on es.io was marked as out-of-scope (OOS). Could you please clarify why this deployment/domain is considered OOS? I want to make sure I fully understand the scope for future reports.

Hi @Attacker_Tester Welcome to the community. All questions / answers about security should be routed to security@elastic.co [image] Product Security at Elastic Safeguarding our customers and community is our top priority; they are at the heart of everything we do. We deeply value ou…

stephenb (Stephen Brown) March 2, 2026, 3:16pm 2

Hi @Attacker_Tester

Welcome to the community.

All questions / answers about security should be routed to

security@elastic.co

1 Like

Topic		Replies	Views
Iptablex trojan experiences? Elasticsearch	13	610	July 6, 2017
ES security measures? Elasticsearch	5	409	July 6, 2017
Security Suggestion In Elasticsearch Elasticsearch	5	441	July 6, 2017
Elasticsearch Vulnerabilities Elasticsearch	7	928	January 5, 2021
Discuss: Security Vulnerabilities: ESA-2023-14 - CVE-2023-31419 Elasticsearch	3	1525	January 4, 2024

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Question About OOS Closure for Elasticsearch Deployment on es.io

Related topics