Report privately through GitHub: Report a vulnerability. Please do not open a public issue for security reports.

You will get an acknowledgment within 3 business days. We keep you informed while we fix the issue, coordinate disclosure with you, and credit you in the advisory unless you prefer otherwise.

The latest release is supported until at least 31 December 2031. Security fixes ship in a new release, free for everyone, with a GitHub security advisory.

Every release carries its own cra-evidence.json, SBOM and signed attestations, recorded by this action. How keelinfra handles the EU Cyber Resilience Act: keelinfra.io/security.