Do not open public GitHub issues for security-sensitive reports.

Email konrad.heimel@gmail.com with:

• Description of the issue and impact
• Steps to reproduce (if possible)
• Affected versions or commits
• Suggested fix (optional)

You should receive an acknowledgment within a few business days. We will coordinate disclosure and a fix release when appropriate.

Kollect is a cluster operator that:

• Reads Kubernetes resources allowed by its RBAC and SAR checks (configurable per target).
• Writes to external sinks using credentials from Secret references only.
• Stores aggregated metadata in CR status (summaries, not full payloads — see ADRs).

Risks to consider when deploying:

• Over-broad ClusterRole grants increase blast radius if the manager is compromised.
• Sink endpoints must use verified TLS; credentials must not appear in CR specs or logs.
• Restrict egress with NetworkPolicy in production.

See Security architecture and controls for trust boundaries, NetGuard, RBAC/SAR, tenancy, redaction, runtime hardening, CI/CD controls, and shared responsibility.

Release builds (.github/workflows/release.yaml) produce:

• OCI images — ghcr.io/platformrelay/kollect and kollect-pipeline, each signed and published with SBOM and SLSA provenance attestations
• cosign keyless signatures (verify with release notes instructions)
• SPDX SBOM — operator and pipeline SBOMs attached to GitHub Releases
• Checksums — sha256sum manifest for install YAML and chart tarball

Prefer tagged release artifacts over :latest in production. Report supply-chain concerns through the private contact above.

Full thresholds and process: SCA remediation policy (satisfies OpenSSF OSPS-VM-05.01).

Vulnerability SLAs: Critical 7 days, High 30 days, Medium 90 days, Low by next minor release; zero tolerance for reachable CVEs (govulncheck must pass before merge) and for fixable CRITICAL/HIGH in release images (Trivy).

License classes: Allow (MIT/Apache/BSD/…), Review (MPL/LGPL — 90 days to confirm), Deny (GPL/AGPL/proprietary/unknown — remove before merge or defer with a dated security issue).

Deferrals require a GitHub issue or ADR with expiry — see policy § Exceptions.

CI runs golangci-lint v2 on code-affecting pushes and pull requests (task lint, job lint in .github/workflows/ci.yaml). Configuration: .golangci.yaml (security and correctness linters including gosec, errcheck, govet, staticcheck, depguard, gomodguard, and logcheck via hack/tooling/.custom-gcl.yml). Pre-commit runs the same gate on changed Go files.

Run locally:

task lint

CodeQL runs on every push/PR to main and weekly (.github/workflows/codeql.yaml); results appear under Security → Code scanning. See ADR-0705 for rationale.

Run locally (requires CodeQL CLI):

# CI equivalent: init → build → analyze via Actions; local runs use the CodeQL extension or CLI.
task lint

Repository settings (enabled 2026-06-05):

• Dependabot alerts and security updates — GitHub Advisory Database notifications and security patch PRs where GitHub supports the ecosystem.
• Renovate — scheduled dependency-update PRs using the repository configuration and least-privilege workflow.

CI runs govulncheck on code-affecting pushes and pull requests (task vulncheck, job vulncheck in .github/workflows/ci.yaml). The scan uses the Go vulnerability database and reports issues that affect imported packages in this module (including test code). The job fails when govulncheck exits non-zero.

Run locally after installing Go from go.mod:

task vulncheck

If a finding is a false positive or only affects an unused code path in a dependency, document the exception in this file (module, advisory ID, rationale, review date) before suppressing CI — see SCA remediation policy § Exceptions and deferrals.

Release images are additionally scanned with Trivy (CRITICAL/HIGH, fixable only) in .github/workflows/release.yaml.

Kollect publishes an OpenVEX document at docs/security/vex.json. Scanner-specific exceptions are also recorded in their checked-in configuration with reachability evidence; currently osv-scanner.toml documents GO-2026-5932 as not called and without an upstream fix.

An ignore is not permission to hide a reachable vulnerability. When a deferral or false positive is accepted, record the advisory, product impact, justification, review trigger, and supporting issue or ADR in OpenVEX and the relevant scanner configuration.

Supply-chain posture is tracked via the OpenSSF Scorecard badge in README.md. Implemented checks, deferred solo-maintainer items, and rationale are documented in ADR-0705 § OpenSSF Scorecard follow-ups.