Only the latest release is supported. Always consume the newest tagged version.

Please do not report security vulnerabilities through public GitHub issues.

1. Go to the GitHub Security Advisory page
2. Click "Report a vulnerability"
3. Fill out the advisory form with detailed information
4. Submit the advisory

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Affected versions (if known)
• Suggested fix (if you have one)

Due to limited development resources:

• Initial Response: we aim to acknowledge receipt within 48–72 hours
• Assessment: initial assessment within about a week
• Resolution: timeline depends on severity, typically 1–4 weeks
• Disclosure: coordinated disclosure after a fix is available

STARTcloud Generic Provisioner is an Ansible-based provisioner package driven by the core_provisioner Vagrant driver. The security-relevant areas are:

• Hosts.yml is trusted input — values from it are interpolated into the generated playbook and shell commands. Only run configurations you wrote or trust.
• Secrets handling — installer server credentials belong in a local secrets.yml override; never commit real credentials to Hosts.yml or the repository.
• The development CA and default certificates — shipped inside the fetched driver/ssls/ tree and synced to /secure/ on dev machines. Never add them to a production trust store; replace with your own certificates for production use.
• Release integrity — release assets are immutable and ship .sha256 sidecars; consumers must verify checksums after download.
• Supply chain — Dependabot runs against this repository; the pinned core driver is sha256-verified at fetch time (driver.version).

Contributors who responsibly report security vulnerabilities will be acknowledged here (with their permission):

• No vulnerabilities reported yet