This is the default security policy for all OpenDecree repositories. Individual repositories may publish their own SECURITY.md with additional detail; where one exists, it takes precedence.
Do not open a public GitHub issue for a security vulnerability.
Report it privately through GitHub Security Advisories on the affected repository:
| Repository | Report |
|---|---|
| Core service, CLI, Go SDKs | decree |
| Python SDK | decree-python |
| TypeScript SDK | decree-typescript |
| Admin GUI | decree-ui |
| Examples | demos |
If you aren't sure which repository is affected, report against decree and we'll route it.
Please include:
- A description of the vulnerability
- Steps to reproduce
- The potential impact
- Any suggested fix (optional)
You should receive a response within 48 hours. We will work with you to understand and address the issue before any public disclosure.
All OpenDecree projects are alpha and are not recommended for production use. During alpha, only the latest release of a given repository receives security fixes — there are no backports to earlier alpha releases. Current published versions are listed in the Current Versions table.
This does not change how we handle reports: alpha status is a reason to report early, not a reason to skip reporting.
Release binaries and Docker images are signed with Sigstore via GitHub Actions artifact attestations (SLSA provenance). Verification instructions are in the affected repository's own SECURITY.md — see decree for the canonical example.
This policy covers code in OpenDecree repositories. It does not cover third-party dependencies (report those upstream), nor deployments of OpenDecree operated by someone else.