Security fixes are applied to the latest release on main. Older tagged releases may not receive backports unless noted in the release notes.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately to:

• Email: info@zyvor.dev
• GitHub Security Advisories: prefer the private advisory form on this repository when enabled (Security → Advisories → Report a vulnerability)

Include:

1. A description of the issue and impact
2. Steps to reproduce or a proof of concept (if available)
3. Affected version, commit, or deployment path

We will acknowledge receipt and work with you on a coordinated disclosure. Do not disclose the issue publicly until we have confirmed a fix or agreed on a disclosure date.

Haven is an identity plane that composes Keycloak and CloudNativePG. Reports about those upstream projects should also be filed with their maintainers; we welcome cross-reports that show how a Haven deploy path is affected.