Security policy

KubePeep takes security seriously. If you find a vulnerability, follow the responsible reporting process below.

How to report

1. Do not open a public issue with vulnerability details.
2. Use the project’s private channels:
   • Security advisories on GitHub (Preferred);
   • SECURITY.md in the official repository, with current contacts and procedures.
3. Include affected version, reproduction steps, impact and, if possible, a proof of concept.

What to expect

• Follow-up: we acknowledge your report.
• Assessment: we assess impact and severity.
• Fix: we prepare a fix and an advisory when applicable.
• Coordinated disclosure: we publish the fix before full technical details.

Scope

Covers KubePeep binaries, installers, local operation and this site. Kubernetes and third-party dependency issues are outside scope; report them to their projects.

Product security guidelines

For the application security model, see Security and RBAC: access requirements and permitted operations come directly from the latest stable release.