If you discover a security vulnerability in ArgoPlane, please report it responsibly. Do not open a public GitHub issue.
Email security@natron.io with:
- A description of the vulnerability
- Steps to reproduce
- Affected versions
- Any potential impact assessment
- Acknowledgment: within 48 hours
- Initial assessment: within 5 business days
- Fix or mitigation: depends on severity, but we aim for patches within 30 days for critical issues
| Version | Supported |
|---|---|
| Latest release | Yes |
| Previous minor | Best effort |
| Older | No |
This policy covers:
- ArgoCD extension backends (Go services)
- ArgoCD extension UIs (React/TypeScript bundles)
- Helm chart templates and default configurations
- CI/CD workflows and container images
Out of scope:
- ArgoCD itself (report to argoproj/argo-cd)
- Third-party operators (Prometheus, Cilium, Trivy, etc.)
- Vulnerabilities in dependencies that are already publicly disclosed (open a regular issue instead)
We follow coordinated disclosure. Once a fix is available, we will:
- Release a patched version
- Publish a security advisory on GitHub
- Credit the reporter (unless they prefer anonymity)
Thank you for helping keep ArgoPlane secure.