Security fixes are made on the master branch and shipped in the next release. Released versions do not receive backported fixes: upgrade to the latest release to get them.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately through GitHub: Report a vulnerability.

Please include:

• the CDS version (cdsctl version, or the version shown in the UI)
• the affected component: API, UI, CDN, hooks, hatchery, worker, cdsctl, or a contrib integration
• how CDS is deployed (binaries, ovhcom/cds-engine Docker image, ...)
• steps to reproduce, and the impact you observed or expect

We will acknowledge your report as soon as possible and keep you informed of the progress towards a fix. Once the fix is released, we publish a GitHub security advisory and credit you, unless you prefer to stay anonymous.

In scope: the code of this repository and the artifacts published from it (GitHub release binaries and the ovhcom/cds-engine Docker image).

Out of scope: the configuration of a self-hosted CDS instance, the docker-compose.yml of this repository (a local demo, not a production setup), and vulnerabilities in third party services CDS integrates with.