Skip to content
This repository was archived by the owner on Oct 24, 2026. It is now read-only.

Repository navigation

Security: thallium-suite/uranium

Security

SECURITY.md

Security Policy

Supported Versions

Branch Supported
main (stable releases) ✅ Security fixes
testing (integration) ✅ Active development
Older releases ❌

Reporting a Vulnerability

Please use GitHub Private Vulnerability Reporting to report security issues.

This ensures your report is handled confidentially before public disclosure.

Do not open a public GitHub issue for security vulnerabilities.

What to include

  • Description of the vulnerability and its potential impact
  • Steps to reproduce or proof-of-concept
  • Affected versions/streams
  • Any suggested mitigations (optional)

Response Timeline

Stage Target
Initial acknowledgment 48 hours
Assessment complete 7 days
Fix/mitigation delivered 30 days (critical), 90 days (high/medium)
Public disclosure After fix ships to :stable

Disclosure Policy

We follow coordinated disclosure. Reporters are credited in the release notes unless they request anonymity. We will not take legal action against researchers who follow this policy.

Scope

This policy covers the thallium-suite/uranium OCI image build pipeline, including:

  • Containerfile and build scripts in build_scripts/
  • GitHub Actions workflows in .github/workflows/
  • Supply chain: base image pinning, COPR repos, binary downloads
  • cosign signing and image integrity

Out of scope: Third-party packages bundled in the image (report upstream), Flatpaks (report to Flathub), Homebrew packages (report to upstream tap).

There aren't any published security advisories