Report vulnerabilities privately through GitHub: on the repository's Security tab choose Report a vulnerability, or go straight to the private report form.

Please don't open a public issue, pull request or discussion for a suspected vulnerability.

A useful report says what you found, how to reproduce it, which version or image digest you ran, and the impact you expect. We'll acknowledge it, keep you updated while we fix it, and agree a disclosure date with you. We credit reporters in the advisory unless you ask us not to.

Fixes land on main and ship in the next release. Only the latest release of the container image (onauto/runtime on Docker Hub) and of the npm package (@on.auto/runtime) receives security fixes, so upgrade to it before reporting if you can.