doktainer-upstream/SECURITY.md

Security Policy

Thank you for helping keep Doktainer and its users secure.

Supported Versions

The following versions currently receive security updates:

Version	Supported
Latest Milestone Release	✅
Previous Milestone Release	✅
Older Releases	❌

As Doktainer is currently in the pre-1.0 phase, users are encouraged to always upgrade to the latest available release.

Reporting a Vulnerability

If you discover a security vulnerability, please do not create a public GitHub Issue.

Instead, report the vulnerability privately through:

• GitHub Security Advisories (preferred)
• GitHub Private Vulnerability Reporting

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested mitigation (if available)

Response Process

After receiving a report, the Doktainer maintainers will:

1. Acknowledge receipt of the report.
2. Investigate and validate the issue.
3. Develop and test a fix.
4. Release a security update if necessary.
5. Publicly disclose the vulnerability after a fix is available.

Scope

Examples of security vulnerabilities include:

• Authentication bypass
• Privilege escalation
• Remote code execution
• Command injection
• Server-side request forgery (SSRF)
• Sensitive information disclosure
• Container escape vulnerabilities
• Insecure secret handling

Disclosure Policy

Please allow maintainers a reasonable amount of time to investigate and address reported vulnerabilities before publicly disclosing them.

Responsible disclosure helps protect Doktainer users and infrastructure operators.

Security Updates

Security fixes may be released as maintenance releases:

• v0.x.1
• v0.x.2
• v0.x.3

or, when necessary, included in the next milestone release.

Acknowledgements

We appreciate responsible security researchers and community members who help improve the security of Doktainer.