# MongoDB C++ Driver SSDLC Compliance Report

## Release Creator

- See [C/CXX Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing).

## Process Document

- Not available. <!-- CXX-3007: replace with link to public-facing document once available. -->

## Tool used to track third party vulnerabilities

- See [Silk](https://us1.app.silk.security/inventory/asset-group/mongodb____DedupedAssetGroup____60640b8853771efe3af5f78ea37af5d1cdd190df) (internal).
- See [SSDLC Compliance Files: C++ Driver](https://drive.google.com/drive/folders/1_qwTwYyqPL7VjrZOiuyiDYi1y2NYiClS) (internal) for release-specific reports. Available as needed from the MongoDB C++ Driver team.

## Third-Party Dependency Information

- See [etc/augmented.sbom.json](https://github.com/mongodb/mongo-cxx-driver/blob/master/etc/augmented.sbom.json) within the release tarball.
- See [etc/third_party_vulnerabilities.md](https://github.com/mongodb/mongo-cxx-driver/blob/master/etc/third_party_vulnerabilities.md) within the release tarball.
- See [SSDLC Compliance Files: C++ Driver](https://drive.google.com/drive/folders/1_qwTwYyqPL7VjrZOiuyiDYi1y2NYiClS) (internal) for release-specific reports. Available as needed from the MongoDB C++ Driver team.

## Static Analysis Findings

- Available as needed from the MongoDB C++ Driver team.

## Security Testing Report

- See [Driver Security Testing Summary](https://docs.google.com/document/d/1y2K_RY4GZVXpQvv4JH_35mSzFRTawNJ3mibpvSBU8H0/edit?usp=sharing) (internal). Available as needed from the MongoDB C++ Driver team.

## Security Assessment Report

- Not applicable to the MongoDB C++ Driver.

## Signature Information

- The source tarball for each release is accompanied by a detached GPG digital signature which may be verified against the `cpp-driver` public key available at https://pgp.mongodb.com/.

## Known Vulnerabilities

- Any vulnerabilities that may be shown in the links referenced above have been reviewed and accepted by the appropriate approvers. For more information, see [SSDLC Compliance Files: C++ Driver](https://drive.google.com/drive/folders/1_qwTwYyqPL7VjrZOiuyiDYi1y2NYiClS) (internal) for release-specific reports. Available as needed from the MongoDB C++ Driver team.
