This provider handles cloud credentials (OTC AK/SK) and provisions billable infrastructure — please report vulnerabilities responsibly.

Please do not open a public issue for security problems. Instead, report it privately via GitHub Security Advisories: use "Report a vulnerability" on the repository's Security tab, and include:

• A description of the issue and its impact (e.g. credential exposure, privilege escalation, resource destruction).
• Steps to reproduce or a proof of concept.
• Affected version/commit.

You will receive an acknowledgement within a few working days. Fixes are released as soon as practical; please allow reasonable time for a fix before any public disclosure.

• The controller reads cloud credentials from a Kubernetes Secret referenced by OTCCluster.spec.identityRef (same namespace only) and never writes credentials to logs, events, status fields, or metrics.
• The manager requires broad Secret access on the management cluster (CAPI bootstrap secrets); treat management-cluster access as production access.
• Reports about leaked OTC resources (orphans after failed teardowns) are ordinary bugs, not security issues — please file a normal issue for those.