This repo's Dockerfile, scripts and workflow: anything that could make an image contain something other than the pinned upstream commit, leak credentials, or publish from an untrusted source.

Report privately: open a security advisory. Please don't open a public issue for it.

The images contain upstream MinIO and mc unmodified. Report MinIO vulnerabilities to MinIO (see their repository's security policy). Once upstream ships a fixed release, open a new-release issue and it will be built here.

Only the tags listed in the README table are built and smoke-tested. Pin one of those, and move to newer releases as they're added.