Security fixes are applied to the latest published release. During the alpha, upgrade to the newest prerelease before reporting a problem.

Do not open a public issue for a suspected vulnerability. Email [email protected] or use GitHub private vulnerability reporting.

Include the affected version, impact, reproduction steps, and any suggested mitigation. Do not include credentials, private source code, or registry tokens unless the maintainers provide a secure channel.

BoringBuilder sends the selected project context to a local Dagger Engine. .gitignore and the built-in source exclusions reduce accidental context, but users remain responsible for excluding secrets from the project and image. Registry authentication is handled by the selected runtime and Dagger; BoringBuilder does not accept credentials on the command line.

config/boringbuilder.rb and files passed with --config are executable Ruby loaded on the host. Review recipes before building source you do not trust.