Security fixes are made on main and shipped in the next release. Only the most recent release receives fixes; older releases are not patched. If you can, please confirm the issue against the latest release or main before reporting.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report them privately through GitHub's private vulnerability reporting: open a new advisory. Only the maintainers can see the report.

Please include as much of the following as you can:

• The version of this operator you are running, and where it is deployed
• Steps to reproduce, or a proof of concept
• The impact as you understand it, including what an attacker would need to exploit it

The maintainers will acknowledge the report, work with you to confirm and understand the issue, and keep you updated on progress toward a fix. Once a fix is released, we will publish a GitHub Security Advisory and credit you unless you ask us not to.

Please give us a reasonable chance to release a fix before disclosing the issue publicly.

In scope:

• The operator and its reconciliation of NebariApp resources into routing, TLS, and authentication configuration
• The nebari-operator and nebari-app Helm charts and the released install.yaml manifests
• The release pipeline and published release artifacts

Out of scope here:

• Vulnerabilities in Envoy Gateway, cert-manager, or Keycloak themselves, unless the issue is caused by how the operator configures them
• Issues that require an attacker to already hold cluster-admin or cloud-account administrator credentials

This repository's Helm charts are published to quay.io/nebari/charts/nebari-operator and quay.io/nebari/charts/nebari-app and signed with Sigstore cosign using keyless signing from the helm-repository release workflow. To verify a version (replace <version>):

cosign verify quay.io/nebari/charts/nebari-operator:<version> \
  --certificate-identity-regexp 'https://github\.com/nebari-dev/helm-repository/\.github/workflows/release-helm-charts\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify quay.io/nebari/charts/nebari-app:<version> \
  --certificate-identity-regexp 'https://github\.com/nebari-dev/helm-repository/\.github/workflows/release-helm-charts\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See Verifying Nebari artifacts for build-provenance attestations and other artifact types.