IceGuard is pre-1.0. Security fixes are applied to the latest release and the main branch.

Please do not report security issues in public GitHub issues.

Use GitHub's private vulnerability reporting: Security tab → Report a vulnerability → Privately report a security vulnerability. This opens a private advisory visible only to the maintainers.

Please include:

• affected version or commit,
• reproduction steps,
• impact / severity, and any suggested fix.

We aim to acknowledge a report within 5 business days and to agree a remediation timeline after triage. Please give us a reasonable window to release a fix before any public disclosure.

• IceGuard connects to your Iceberg catalogs and object stores. Credentials you register are stored in IceGuard's own PostgreSQL — protect that database and restrict who can register or read catalogs.
• OIDC is disabled by default. Do not expose an instance publicly without putting authentication in front of it (reverse proxy / SSO) and locking down network access.
• Never commit secrets. .env, key/*.key, *.pem and credential files are git-ignored; use environment variables or a secrets manager instead.