Ahoy, security-minded sailor. If ye spot a cursed leak, a leaky hull, or a suspicious barnacle clingin' to Privateerr, this be the proper chart for reportin' it.

Privateerr sails by the stable latest image and the edge image built from main. Since this project be a small vessel, security fixes target those newest charts instead of older treasure maps.

Please do not open a public GitHub issue for secrets, credential leaks, auth bypasses, or anything that could help another scallywag attack a user.

Report vulnerabilities using GitHub's private vulnerability reporting form. To find it from the repository:

1. Go to the repository's Security tab.
2. Choose Report a vulnerability.
3. Include clear steps to reproduce, affected files, logs, container tags, and any relevant Docker Compose settings.

Do not send vulnerability details through Discord, discussions, issues, or pull requests. Those routes are for non-sensitive support and public collaboration.

If private vulnerability reporting is unavailable, open a GitHub issue containing only a brief, non-sensitive request for a private reporting channel. Do not describe the vulnerability publicly.

Helpful reports include:

• What ye found.
• How to reproduce it.
• What version, branch, image tag, or commit ye tested.
• Whether it affects Privateerr code, the Docker image, Gluetun integration, or upstream PIA scripts.
• Any safe logs with secrets removed.

This be a small maintainer ship, not a giant navy. I will do my best to:

• Acknowledge valid private reports within 7 days.
• Triage severity and scope as soon as possible.
• Patch accepted issues in main and publish the fix to edge.
• Publish a stable semantic-version release when the fix is ready for latest.
• Credit reporters when requested and safe to do so.

If a report is declined, I will try to explain why without leakin' dangerous details into open waters.

Privateerr images are built from pinned Alpine image digests, not floating latest bases. GitHub Actions are pinned to full commit SHAs for the same reason: the same source commit should build from the same known cargo unless a dependency update is reviewed and merged.

Renovate watches the pinned Docker bases, GitHub Actions, Compose images, and submodules. When Alpine, an action, or another watched dependency moves, Renovate opens a pull request. The dependency only changes after that PR passes CI and lands on main.

The protected build path then:

• Uses pre-commit and CodeQL before pull requests can land.
• Runs OpenSSF Scorecard on its own schedule and branch-protection events.
• Builds Privateerr and Buccaneerr for linux/amd64, linux/arm64, and linux/arm/v7.
• Scans built images with Trivy before publishing.
• Publishes edge from main after checks pass.
• Publishes exact, minor, major, and latest aliases from stable semantic-version tags.
• Attests build provenance and mirrors Privateerr from GHCR to Docker Hub with digest preservation.

Rebuilding the same commit keeps the pinned base image, but uncached APK installation can pick up newer packages from Alpine. Renovate updates base and tool pins separately. Pull the resulting edge image or publish a stable release to deliver fixes to latest.

See the container scan review for the September 2026 dependency fixes and the upstream evidence behind remaining package-level alerts.

Use the support guide for non-sensitive setup questions and reproducible bugs.

Fair winds, sharp eyes, and may yer secrets stay below deck. ☠️