[Question] How to report security vulnerabilities?

[JarLob]

Hi, I am a member of GitHub Security Lab and would like to report a potential security vulnerability. What is the best way to do it? I tried to send the report to security at kpt.dev, but didn't receive a reply.

[SurbhiAgarwal1]

Hi @JarLob,

Thanks for reporting this and for trying to contact the security team.

Since this may involve a security vulnerability, please avoid sharing any sensitive details publicly in this issue. Could you please try reporting it through GitHub's private vulnerability reporting mechanism, if enabled for the repository, or contact the kpt maintainers through the Kubernetes Slack #kpt channel for guidance on the appropriate private reporting channel?

Once the report is received through the appropriate channel, the maintainers should be able to assist with the next steps.

Thank you for responsibly reporting the issue.