If you discover a security vulnerability in Attune, please report it responsibly.
DO NOT create a public GitHub issue for security vulnerabilities.
Instead, please report vulnerabilities via GitHub's private security advisory feature: Report a vulnerability.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Previous release | Security fixes only |
| Older | No |
- Container images and binaries are signed with cosign using keyless signing (Sigstore OIDC)
- SLSA build provenance is generated for binary artifacts and container images using GitHub's native attestations
- SBOMs are generated for every release (SPDX format) and attached to the GitHub release
- FOSSA license compliance scanning runs on pull
requests and main pushes that change Go sources,
go.mod,go.sum, the filter script, or the License Compliance workflow. Manual dispatch is also available.
- Trivy filesystem and container image scans run weekly
- govulncheck runs weekly for known Go vulnerabilities
- Gitleaks secret detection runs on every push
- CodeQL static analysis runs weekly
- GitHub secret scanning is enabled at the organization level
- StepSecurity harden-runner is enabled on all CI workflows
- OpenSSF Scorecard monitors the repository's security posture
- Dependabot monitors Go modules, GitHub Actions, and Docker base images weekly
- Static analysis via golangci-lint (50+ linters) runs on every push
- The operator runs as non-root (
runAsUser: 65532) with a read-only root filesystem - All Linux capabilities are dropped (
drop: ALL); privilege escalation is disabled - RBAC permissions follow least-privilege principles