Only the latest released version of TinySearch receives security fixes.

Pull requests and release images are checked before publication:

• Configuration scan — the Dockerfile is scanned with Trivy for CRITICAL and HIGH misconfigurations.
• Secret scans — the repository, image filesystem, and image metadata are scanned for exposed credentials.
• Vulnerability scan — the built image is scanned for fixable CRITICAL and HIGH operating-system and application dependency vulnerabilities.
• Recurring scan — the published latest image is rescanned weekly so newly disclosed vulnerabilities are detected after release.
• Non-root service — the entrypoint starts as root only to repair ownership of bind-mounted directories, then immediately runs TinySearch as the unprivileged tinysearch user through gosu.
• Minimal packaging tools — dependency consistency is checked with pip check, then pip and setuptools are removed from the runtime image.
• Build attestations — published images include an SBOM and max-level build provenance generated by Docker Buildx.
• Signed images — the published multi-architecture image digest is signed keylessly with Cosign through GitHub OIDC.

Verify a published image with:

cosign verify \
  --certificate-identity-regexp "https://github.com/TinySuiteHQ/TinySearch/.github/workflows/docker-publish.yml@.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  marcellm01/tinysearch:<tag>

See .github/workflows/ci.yml, .github/workflows/docker-publish.yml, and .github/workflows/docker-security.yml for the enforced checks.

Please report security issues privately through GitHub Security Advisories rather than filing a public issue. Include reproduction steps and the affected version. We will acknowledge reports within a few days.