Email security@usedock.io. Do not open a public issue, pull request or discussion for a vulnerability.

Include what you found, how to reproduce it, the affected version or commit, and the impact you expect. We reply within 3 business days and keep you updated until it is fixed.

We follow a 90-day disclosure window: we aim to ship a fix within 90 days of your report, and ask that you keep details private until the fix is released or 90 days have passed, whichever comes first. We credit reporters in the release notes unless you prefer otherwise.

All repositories in the usedock organization, the container images and release binaries once published. Escaping a dock to reach the host, another dock, connector credentials or the control plane database is always in scope.

Only the latest release receives security fixes.