To report security issues in LLVM components of Arm Toolchain, please follow LLVM Project security policy.

To report security issues in any other components of Arm Toolchain, please use the Report a vulnerability feature under the Security tab.

Please refer to What is considered a security issue? in LLVM Project for an overview of which toolchain components are considered security-sensitive.

The picolibc and newlib standard C libraries are not part of the llvm-project, however Arm Toolchain treats these in the same way as the llvm-project runtime libraries.