Report it privately. Don't put details of a vulnerability in a public issue, comment or pull request.
- Open the repository's Security tab on GitHub (https://github.com/stump-wtf/cairn/security). If it offers Report a vulnerability, use it. That form is private between you and the maintainers.
- If that button isn't there, open an issue at
https://github.com/stump-wtf/cairn/issues titled
Security contact request, with no details about the problem. A maintainer will reply with a private channel to send them through.
Please include:
- the version: the image tag plus digest, or the commit you built;
- the surface: web, CLI, MCP or the REST API;
- the steps to reproduce, and what an attacker gains.
Never send real credentials, even in a private report. That covers API tokens,
OAuth or session cookies, webhook ingress URLs, and the contents of anyone
else's artifacts. Use <redacted> or a throwaway instance.
Only the latest release gets security fixes. Today that is the v0.1.x line,
published as the container image ghcr.io/stump-wtf/cairn. If you run an older
image, upgrade before reporting, and check whether the problem is still there.
In scope: the Cairn server (cairnd, including its web UI, REST API and MCP
endpoint), the cairn CLI, and the container image.
Out of scope: problems in an instance's own setup, such as a reverse proxy, the identity provider, Postgres or the object store, unless Cairn's defaults or documentation caused them.