Do not open a public issue. Write to us through the bespinian contact form, so we can fix it before it is public.

Please include:

• what an attacker can do, and what they need first
• the steps to reproduce it
• the output of keera version, or the image tag

We confirm that we got your report, keep you informed while we work on it, and credit you when the fix is out, unless you would rather stay anonymous.

Only the latest release gets security fixes.

Every release archive and image is signed with build provenance. docs/install.md shows how to check it.