Only the latest release of CanyonOS receives security fixes.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report them privately through GitHub's private vulnerability reporting.

Please include:

• the CanyonOS version and how you deployed it (local or cloud);
• a description of the issue and its impact;
• steps to reproduce it, or a proof of concept.

We will acknowledge your report, work with you on a fix, and credit you in the advisory unless you ask us not to. Please give us a reasonable time to release a fix before disclosing the issue publicly.