# Security policy

## Supported versions

Security fixes go into the latest release only. Check the [releases page](https://github.com/isac322/pillar-csi/releases) for the current version and upgrade to it before you report.

## Reporting a vulnerability

Report vulnerabilities privately through [GitHub Security Advisories](https://github.com/isac322/pillar-csi/security/advisories/new). Do not open a public issue or pull request for a security problem.

Include the pillar-csi version, how you installed it (chart values that differ from the defaults, especially `mtls.*`), and the steps or configuration that reproduce the problem. If you know the impact, such as an unauthorized node reaching a volume, say so.

The maintainer will reply in the advisory thread, and the fix and advisory are published together once a patched release is available.