If you discover a vulnerability in karpenter-provider-hetzner please report
it privately. Do not open a public GitHub issue.
Email: security@echohello.dev (or open a private GitHub advisory at
https://github.com/echohello-dev/karpenter-provider-hetzner/security/advisories/new).
Include:
- A description of the vulnerability and impact.
- A reproducer (Hetzner project, karpenter version, cluster topology).
- Your contact details.
- Acknowledgement within 2 business days.
- Triage assessment within 7 days.
- Coordinated disclosure timeline agreed with you before any fix ships.
Only the latest released minor is patched. Older releases are best-effort.