Zublo is currently maintained as a rolling project. Security fixes are expected to land on the default branch and in the latest published container image.

Please do not open public GitHub issues for suspected security vulnerabilities.

Preferred disclosure path:

1. Use GitHub's private vulnerability reporting for this repository, if enabled
2. If private reporting is unavailable, contact the maintainer via the repository owner profile at @danielalves96 and request a private channel

Please include:

• a clear description of the issue
• affected area or file path
• impact assessment
• reproduction steps or proof of concept
• any suggested mitigation if you already have one

Best-effort targets:

• initial acknowledgement within 7 days
• follow-up once triage is complete
• public disclosure only after a fix or mitigation path exists

Use the security channel for:

• authentication or authorization flaws
• sensitive data exposure
• remote code execution
• privilege escalation
• vulnerabilities in published images or distribution artifacts

Use the normal support path for:

• setup help
• documentation gaps
• general bug reports without security impact