Security: sajjadlabx/homebrew-tap

Join the kubestellar-security-announce group for emails about security and major announcements.

We're extremely grateful for security researchers and users that report vulnerabilities to the KubeStellar Open Source Community. All reports are thoroughly investigated by community volunteers.

To report a vulnerability privately, use one of the following channels:

1. GitHub Security Advisories — open a private report at: https://github.com/kubestellar/homebrew-tap/security/advisories/new

2. Email — send details to the private security list: kubestellar-security-announce@googlegroups.com

Please do not open a public GitHub issue for suspected security vulnerabilities.

• A description of the issue and its potential impact
• Whether the problem is in a formula file, the release/GoReleaser pipeline, a workflow, or repository infrastructure
• Steps to reproduce or validate the issue
• Any proof-of-concept, hashes, raw URLs, or logs that help confirm impact
• Suggested mitigations, if known

• You believe a formula in this tap delivers a compromised or malicious binary
• You found a vulnerability in a workflow or the GoReleaser release pipeline that could affect distributed binaries
• You discovered a supply-chain issue that could affect kc-agent, kubestellar-ops, or kubestellar-deploy as distributed via Homebrew

• You have a question about how to use one of the tools (use Slack instead)
• The issue is in the upstream source code rather than the distribution pipeline (report upstream in kubestellar/kubestellar-mcp or kubestellar/console)

Each report is acknowledged and analyzed by the maintainers within 3 working days.

Vulnerability information shared with the security team stays within the KubeStellar project and will not be disclosed publicly until a fix is available and coordinated with the reporter.

A public disclosure date is negotiated between the KubeStellar Security Response Committee and the reporter. We prefer to disclose as soon as a mitigation is available. For straightforward issues, expect 7 days from report to disclosure.