Do not report vulnerabilities through public issues. Share the affected component, reproduction steps, impact, and suggested mitigation privately with the repository owner.

• The local deployment worker has access to the Docker socket. Treat it as host-level access, bind the API to localhost, and deploy only repositories you trust.
• Keep public dashboard hosting read-only. Do not expose the Docker-backed control-plane API directly to the internet.
• Compose repositories must be reviewed for privileged containers, host filesystem mounts, host networking, devices, and Docker socket mounts before registration.
• Set AUTH_DISABLED=false outside local development.
• Store JWT, database, Jenkins, registry, and cloud credentials in a secret manager.
• Use TLS at ingress and restrict the Kubernetes API by network and identity.
• Grant DeployPilot a namespace-scoped service account unless cluster-wide inventory is explicitly needed.
• Verify and sign release images, pin them by digest, and scan them before promotion.
• Protect Terraform state with encryption, versioning, and limited IAM access.