We only support the latest version on the main branch. Please ensure you are using the latest commit before reporting a vulnerability.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please report vulnerabilities via one of:

1. GitHub Security Advisories: Use the "Report a vulnerability" button on the Security tab of this repository.
2. Email: Send details to security@your-domain.com (replace with your actual security contact).

• Description of the vulnerability.
• Steps to reproduce.
• Potential impact.
• Suggested fix (if any).

• Acknowledgment: Within 48 hours.
• Initial assessment: Within 5 business days.
• Fix or mitigation: Depends on severity, but we aim for:
  • Critical: 7 days
  • High: 14 days
  • Medium/Low: 30 days

This starter platform implements the following security practices:

• No secrets in Git — all secrets are managed via HashiCorp Vault.
• Vault uses Kubernetes auth for pod identity.
• External Secrets Operator syncs secrets from Vault to Kubernetes Secrets at runtime.
• Vault audit logging is enabled by default.

• Argo CD uses project-scoped RBAC (see docs/06-argocd-ops.md).
• Kubernetes RBAC follows least-privilege principles.
• Service accounts are scoped per application.

• Ingress is TLS-terminated via cert-manager.
• Network policies are provided as optional examples.
• Internal service communication uses ClusterIP (no unnecessary exposure).

• Example app images use distroless/minimal base images.
• Images are pinned by digest in production overlays.
• No containers run as root.
• Read-only root filesystems where possible.

• All Helm chart versions are pinned in platform/versions.yaml.
• CI validates manifests with kubeconform.
• Dependabot / Renovate configuration is recommended (see ROADMAP.md).

We follow responsible disclosure. We will credit reporters in release notes unless they prefer to remain anonymous.