Do not open a public issue. Use Private Vulnerability Reporting.
Reports are accepted in English or Russian. Initial response within 7 days. Fix targets: Critical — 7 days, High — 30 days.
- Acknowledge the report within 7 days.
- Confirm and assess severity (CVSS) privately in a draft security advisory.
- Fix in a private fork of the advisory; rebuild affected templates.
- Publish the advisory and a CHANGELOG entry, crediting the reporter unless they ask for anonymity.
- Request a CVE through GitHub when applicable.
Fix targets apply from confirmation. What the images do and do not guarantee is described in docs/security.md.
- Packer templates, scripts, the image playbook;
- GitHub Actions workflows;
- Talos Image Factory schematic.