Older releases are not actively patched. Users are encouraged to always use the latest release.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub Security Advisories.

Include as much detail as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Affected versions
• Any suggested mitigations

You can expect an acknowledgement within 5 business days and a status update within 14 days.

This project uses automated security scanning in CI/CD:

Scan results for CRITICAL and HIGH severity findings are uploaded to the GitHub Security tab as SARIF reports, where they can be reviewed and tracked.

• The Docker image is built on chainguard/wolfi-base, a minimal, hardened base image with a low CVE surface area. All installed packages are upgraded to their latest patched versions during the build. kubectl is intentionally excluded from the image since it is not used by the tool, reducing the attack surface. The image includes skopeo as the preferred daemonless alternative to docker/podman.
• The standalone Linux binary is built with PyInstaller on ubuntu-latest GitHub Actions runners and published directly as a GitHub Release asset.
• All CI/CD workflows use pinned action versions and rely only on GITHUB_TOKEN with least-privilege permissions — no external secrets are required.