Please report vulnerabilities privately, not in public issues, pull requests or discussions:

• through GitHub's private vulnerability reporting ("Report a vulnerability" on the repository's Security tab), or
• by email to cloud-service@elixir-europe.org.

Please include, as far as you can:

• the affected version (release or commit);
• the relevant configuration (without secrets);
• steps to reproduce, ideally a minimal example;
• the impact, i.e., what an attacker can achieve.

Security fixes are made on dev and released in a new version of the latest release series (the latest minor version). Older versions get fixes only for critical issues, at the maintainers' discretion.

The maintainers acknowledge the report, assess it, and, if they confirm it, develop a fix in private. They publish the fix with a GitHub security advisory (with a CVE where appropriate), coordinating the timing with the reporter, and credit reporters who wish to be credited. The project is maintained on a best-effort basis: there are no guaranteed response or fix times.

This policy covers the code of this repository and the artifacts published from it (the container images and the Helm chart). Vulnerabilities in deployments run by third parties go to their operators, and those in dependencies to their projects; tell us too if they affect proTES.