clusterflux-public/SECURITY.md

Security reporting

Supported versions

Security fixes are applied to the current main branch and the most recent published Clusterflux release. Older preview releases are not maintained.

Report a vulnerability

Email security@clusterflux.lesstuff.com with a concise description, affected version or source revision, reproduction steps, and impact. Do not open a public issue for an unpatched vulnerability or include credentials, session tokens, private keys, provider tokens, customer data, or operator secrets in a public report.

You should receive an acknowledgement within three business days. We will coordinate validation, remediation, release timing, and disclosure with you. Avoid accessing data that is not yours, disrupting the hosted service, or retaining sensitive data beyond what is necessary to demonstrate the issue.