workato-dev-kit has not cut formal version tags yet.
Security fixes are applied only to the latest commit on main.
Consumers should pull the latest via git submodule update --remote kit.
| Version | Supported |
|---|---|
main (latest) |
✅ |
| Older commits | ❌ |
If you discover a security vulnerability, please report it privately — do not open a public issue.
- Open the repository's Security tab
- Choose "Report a vulnerability"
- Fill in the details
GitHub's Private Vulnerability Reporting lets you communicate with the maintainers securely.
If GitHub Security Advisories is not available to you, email the maintainer directly.
- Email: kantannano@gmail.com
- Subject prefix: please prefix with
[SECURITY] workato-dev-kit:
- The affected file or component (e.g.
setup.sh,scripts/sync_agents.py, or a specific skill) - Reproduction steps (a minimal PoC)
- Expected impact (information disclosure / arbitrary code execution / privilege escalation, etc.)
- Whether you want to be credited (and if not, please say so)
Maintainers respond as quickly as they can, but this is a volunteer-run project, so we cannot guarantee timing. As a rough guide:
| Step | Target |
|---|---|
| Acknowledgement | Within 7 days |
| Impact assessment | Within 14 days |
| Fix release | Depends on severity |
Vulnerabilities in the code in this repository are in scope.
Out of scope:
- Vulnerabilities in Workato itself (report to Workato)
- Misconfiguration of consumer repositories (e.g. a leaked
.workatoenv) — that is the consumer's responsibility - Vulnerabilities in the Workato Platform CLI itself (report to workato-platform-cli)
- Vulnerabilities in external services we integrate with (Claude Code, Cursor, Codex CLI, Gemini CLI, etc.)
- Once a fix is released, we publish a GitHub Security Advisory.
- We credit reporters who want to be credited.
- We obtain a CVE for high-severity issues when appropriate.