dockpipe is pre-1.0. Security fixes are applied on the current development line and shipped in new releases (see repo-root VERSION and GitHub Releases).
| Version | Supported |
|---|---|
Latest 0.x release |
✅ Yes — install the newest tag / package. |
Older 0.x |
❌ No — please upgrade; we do not maintain long-lived backport lines yet. |
After 1.0, this table will be updated with explicit minor-version support.
Please do not open a public issue for undisclosed security bugs.
- Preferred: Use GitHub → Security → Report a vulnerability (private advisory) if the feature is enabled on the repo.
- Alternative: Email the maintainer with
[dockpipe-security]in the subject (use the contact method you prefer to publish in your profile or org readme if you add one).
- Description of the issue and impact
- Steps to reproduce (or a proof-of-concept), if possible
- Affected versions / platforms (if known)
- We aim to acknowledge within a few business days.
- We’ll coordinate a fix and release; you’ll be credited in the advisory / release notes if you want.
- If the report is out of scope or not accepted, we’ll explain briefly.
The repository runs govulncheck, gosec, and CodeQL in CI; that does not replace responsible disclosure for issues you find in application logic or container workflows.