Please don't open a public issue, discussion or pull request for a security problem.

Report it privately: on the repository's page, open the Security tab and choose Report a vulnerability. Only you and the maintainer see the report. GitHub's walkthrough: Privately reporting a security vulnerability. There is no security email address.

Include what you found, the version, how to reproduce it, and what an attacker could do with it. You'll get an acknowledgement, then a fix or a reasoned answer; we agree a disclosure date with you and credit you in the release notes unless you prefer not to be.

Security fixes go into the latest release. Kept has its own policy, with supported versions and how to verify a signed release: keptinventory/kept › SECURITY.md.

Kept is self-hosted: test on your own instance, never on someone else's.