The Tekton project takes security seriously. We appreciate your efforts to responsibly disclose any security vulnerabilities you find.

The Tekton project maintains four LTS release branches for each project, resulting in an overall support window of approximately one year. Security fixes are backported to all supported LTS releases. See the Tekton support policy for details.

For a detailed overview of our security architecture, trust boundaries, and potential threats, please refer to the specific Threat Model for each project:

• Tekton Pipeline: Pipeline Security Threat Model

Please do not report security vulnerabilities through public GitHub issues.

To report a vulnerability, use the GitHub Security Advisory form of the affected repository: open the repository's Security tab and click Report a vulnerability.

If that button is not available on the affected repository, please email the Tekton Vulnerability Management Team (VMT) at tekton-vmt[at]googlegroups.com instead. GitHub cannot move advisories between repositories, so please do not file it on an unrelated repository as a catch-all. If the issue is genuinely cross-cutting, or you cannot tell which repository is affected, you may use the pipeline repository; the VMT may recreate the report in the correct repository.

You can always email the Tekton Vulnerability Management Team (VMT) at tekton-vmt[at]googlegroups.com with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.

Our vulnerability management team will respond within 3 working days of your report. If the issue is confirmed as a vulnerability, we will open a Security Advisory.

This project follows a 90 day disclosure timeline.

1. Confirm the vulnerability and determine affected versions
2. Develop and test a fix
3. Release patches for all supported versions
4. Publish a GitHub Security Advisory with a CVE identifier

We follow a coordinated disclosure process. We ask that you:

• Allow us reasonable time to investigate and address the vulnerability before public disclosure
• Avoid exploiting the vulnerability beyond what is necessary to demonstrate it
• Do not access or modify other users' data

Security advisories for Tekton projects are published on the respective GitHub repositories:

• Tekton Pipeline
• Tekton Chains
• Tekton Results
• Tekton Triggers
• Tekton Operator
• Tekton Dashboard