Do not open a public issue for a security problem.
Report it privately through GitHub's private vulnerability reporting (the repository's Security tab, then Report a vulnerability). If that form is unavailable, contact the maintainer privately through GitHub before disclosing anything.
Security contact: James Maes (@KofTwentyTwo), maintainer.
Please include the affected orb version, the .munitor.yml pipeline type, how to
reproduce it, and the impact you see. Never include secrets or CircleCI context values.
KofTwentyTwo follows coordinated vulnerability disclosure. Timeframes are counted from the day the report arrives and come from the KofTwentyTwo security program:
| Step | Target |
|---|---|
| Acknowledge the report | 7 days |
| Assess it: confirm or reject, with a severity | 14 days |
| Release a fix for a CRITICAL vulnerability | 7 days |
| Release a fix for a HIGH vulnerability | 30 days |
| Release a fix for a MEDIUM vulnerability | 90 days |
| Release a fix for a LOW vulnerability | The next release |
| Publish the advisory (GitHub Security Advisory, CVE where applicable) | When the fix ships, or 90 days after the report, whichever comes first |
Reporters are credited in the advisory unless they ask not to be.
| Version | Security fixes |
|---|---|
0.3.x (kof22/munitor@0.3) |
Yes |
| Older | No; upgrade to the latest release |
Only the latest minor line receives fixes; a line ends when the next minor version is published to the CircleCI orb registry.
Munitor runs inside the consumer's CircleCI project with the consumer's contexts (registry, GitHub, SonarCloud, NVD). Issues that let a generated pipeline leak context secrets, push an image or GitOps change for the wrong commit, or bypass a security gate are in scope.
Fixed vulnerabilities are published as GitHub Security Advisories.