Cardea actively maintains security updates for the following versions:
| Version | Supported | Notes |
|---|---|---|
0.2.5 |
✅ | Current release |
< 0.2.5 |
❌ | Unsupported; please upgrade to latest |
We take the security of Cardea and agent skills seriously. If you discover a security vulnerability, please report it responsibly.
- GitHub Private Vulnerability Reporting: When enabled on the repository, please submit reports directly via GitHub Private Vulnerability Reporting.
- Public Issues Warning: DO NOT report security vulnerabilities, exploit details, or potential security flaws in public GitHub Issues, Discussions, or Pull Requests.
Important
Owner Setup Blocker: A dedicated private security email address and automated private reporting channel are currently pending repository owner configuration. Until private vulnerability reporting is enabled in repository settings by the owner, please avoid posting sensitive vulnerability details publicly.
- Receipt & Acknowledgement: Once a private advisory is submitted, maintainers will review and confirm the vulnerability.
- Investigation & Fix: Maintainers will triage the issue, assess severity, and develop a patch in a private branch.
- Release & Advisory: A patched release will be issued alongside a published GitHub Security Advisory detailing the fix and credit to the reporter.