Security fixes are applied to the latest release and the main branch.

Please do not report security vulnerabilities through public issues, discussions, or pull requests.

Use GitHub's private vulnerability reporting instead: https://github.com/kyverno/assistant/security/advisories/new

Include as much of the following as you can:

• A description of the issue and its potential impact
• Steps to reproduce, or a proof of concept
• Affected versions, image tags, or commits
• Any suggested mitigation

• We aim to acknowledge reports within 5 business days.
• We will keep you updated as we investigate and prepare a fix.
• Once a fix is released, we will publish a security advisory and credit the reporter unless they prefer to remain anonymous.

Published container images are signed and ship with provenance attestations. Verify them before use rather than trusting a tag alone.