Please report security issues privately — do not open a public issue for an unfixed vulnerability.

• Preferred: GitHub Security → Report a vulnerability on https://github.com/epheo/dotvirt (private advisory).
• Or email github@epheo.eu with the details and, if possible, a reproduction.

You can expect an acknowledgement within a few days. Once a fix is available it is released as a new digest-pinned version (see hack/release.sh) and, where relevant, a GitHub Security Advisory.

dotvirt's runtime owns nothing: it reads git/cluster/Argo and proposes pull requests, riding the calling user's RBAC. The privileged install RBAC and the forge-admin credential live only in the operator (install-time), kept distinct from the app's narrow clone/push token. Reports that concern privilege boundaries between these two identities, the user-token pass-through, or the GitOps PR-merge gate are especially welcome.

Only the latest released version is supported. dotvirt is pre-1.0 (v1alpha1); fixes land on main and in the next release.