We release patches for security vulnerabilities for the following versions:

If you discover a security vulnerability, please report it by:

1. DO NOT open a public issue
2. Email the maintainers or use GitHub's private vulnerability reporting
3. Include detailed information about the vulnerability:
   • Type of vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will respond within 48 hours and provide regular updates on the fix progress.

Our CI/CD pipeline implements multiple security layers:

1. Fork PR Protection: Pull requests from forks require manual approval (via safe-to-build label) before builds run
2. SBOM Generation: Software Bill of Materials is generated for all builds
3. Provenance Attestation: Build provenance is recorded for supply chain security
4. Limited Permissions: Workflows use minimal required permissions
5. No Push from PRs: Pull requests only build images locally, never push to registry

• Verified amd64 image builds
• Regular base image updates
• Minimal attack surface
• Non-root user execution where possible

• Automated dependency updates via Dependabot
• Security alerts enabled
• Regular security audits

When contributing:

1. Never commit secrets, tokens, or credentials
2. Use environment variables for sensitive configuration
3. Keep dependencies up to date
4. Follow principle of least privilege
5. Validate and sanitize all user inputs
6. Use parameterized queries for database operations

Our repository includes:

• Dependabot for dependency updates
• GitHub Security Advisories monitoring

For maintainers reviewing fork PRs:

1. Review the PR code thoroughly for malicious content
2. Check for suspicious file modifications
3. Verify no secrets or credentials are exposed
4. Only add safe-to-build label if code is verified safe
5. Remove label immediately if concerns arise

Security updates are prioritized and released as soon as possible. Subscribe to repository releases to stay informed.