| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
The Subzero team takes security issues seriously. If you discover a security vulnerability in Subzero, please report it privately:
- GitHub Security Advisory: Report privately via GitHub Security Advisories.
- Details to include:
- Description of the vulnerability and affected component (Supervisor, Worker, Wasm runtime, Management API, Transport layer).
- Minimal proof of concept (PoC) code or steps to reproduce.
- Any potential attack vectors (e.g., guest sandbox escape, zip-slip, privilege escalation, unauthorized hostcall).
- Response timeline:
- Initial acknowledgement: within 48 hours.
- Assessment and coordinated disclosure plan: within 7 business days.
Please do not disclose security issues publicly until a patch has been released and coordinated.