Security fixes are made on main and shipped in the next release. Only the most recent release receives fixes; older releases are not patched. If you can, please confirm the issue against the latest release or main before reporting.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report them privately through GitHub's private vulnerability reporting: open a new advisory. Only the maintainers can see the report.

Please include as much of the following as you can:

• The version of this template you are running, and where it is deployed
• Steps to reproduce, or a proof of concept
• The impact as you understand it, including what an attacker would need to exploit it

The maintainers will acknowledge the report, work with you to confirm and understand the issue, and keep you updated on progress toward a fix. Once a fix is released, we will publish a GitHub Security Advisory and credit you unless you ask us not to.

Please give us a reasonable chance to release a fix before disclosing the issue publicly.

In scope:

• The template's chart, workflows, and default configuration that new packs inherit

Out of scope here:

• Vulnerabilities in a pack generated from this template; report those to that pack's repository
• Vulnerabilities in the Nebari platform itself; report those to Nebari Infrastructure Core or nebari-operator
• Issues that require an attacker to already hold cluster-admin or cloud-account administrator credentials