ILM is committed to providing a secure platform for its users. We are continuously improving our security measures to protect the platform from potential threats, and we are grateful to everyone who reports a vulnerability responsibly.

Please do not report security vulnerabilities in public issues, pull requests, or discussions. A public report exposes users of the platform before a fix is available.

Report a vulnerability privately in one of two ways:

• GitHub private security advisory — open the Security tab of the affected repository and choose Report a vulnerability. This is enabled on every repository in the organization and is the preferred route, because it keeps the report, the discussion, and the fix together.
• Email — write to ilm@omnitrust.com if you cannot use GitHub, or if the issue affects the platform as a whole rather than one repository.

Please include:

• A clear and concise description of the vulnerability or security issue.
• Affected components, including the version.
• Steps to reproduce, or a proof of concept.
• The impact you believe the issue has.
• A link to the CVE description, if one already exists.
• Any other information that helps us understand and resolve the issue.

• We acknowledge a report within 3 business days.
• We provide an initial assessment, including whether we can reproduce the issue and how we rate its severity, within 10 business days.
• We keep you informed while we work on a fix, and we credit you in the published advisory unless you prefer otherwise.

We ask that you give us time to release a fix before disclosing the issue publicly. We aim to publish an advisory within 90 days of the report, or sooner once a fix is available. If a vulnerability is already being exploited, we will move as quickly as we can and will coordinate the announcement with you.

Our development process includes automated vulnerability management: dependency scanning, static analysis of the code, secret detection, and vulnerability scanning of published artifacts. Fixes for reported vulnerabilities are released through the same process, and published as GitHub security advisories.

Released artifacts and container images are signed. The verification key is published as cosign.pub in this repository.

Verify a release's checksum file, then check the artifacts against it:

cosign verify-blob --key cosign.pub --signature checksums.txt.sig checksums.txt

Verify a container image digest:

cosign verify --key cosign.pub <image-reference>