Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, use GitHub's private vulnerability reporting: Report a vulnerability.

Include as much of the following as you can:

• Affected component (endpoint, package, config surface) and version/tag
• Reproduction steps or proof-of-concept
• Impact assessment (what an attacker gains)
• Any suggested remediation

You can expect an acknowledgement within 7 days and a status update within 30 days. Please allow us reasonable time to ship a fix before public disclosure; we will credit reporters in the release notes unless you prefer otherwise.

Container images are signed with cosign (keyless, GitHub OIDC) and every release ships SPDX SBOMs plus SHA-256 checksums — verification commands are in the README.

• Security Architecture
• Security Hardening Guide
• Production Security Checklist
• Account Lockout