Security updates will be released after vulnerabilities have been identified and fixed. The project as a whole has no major version releases, but every individual repository may have a list of supported versions for certain components. Read the SECURITY.md file on every repository for more information about the supported versions of every component.

Please provide a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.

The preferred way to report a security issue is through GitHub Security Advisories. See Privately reporting a security vulnerability for instructions on how to report a security vulnerability using GitHub's security advisory feature.

You may also send email to security@ubuntu.com. Email may optionally be encrypted to OpenPGP key 4072 60F7 616E CE4D 9D12 4627 98E9 740D C345 39E0.

The Charmed HPC core developer team will be notified of the issue and will work with you to determine whether the issue qualifies as a security issue and, if so, in which component. We will then figure out a fix, get a CVE assigned, and coordinate the release of the fix.

If you have a deadline for public disclosure, please let us know. Our vulnerability management team intends to respond within 3 working days of your report. This project aims to resolve all vulnerabilities within 90 days.

The Ubuntu Security disclosure and embargo policy contains more information about how can contact us, what you can expect when you contact us, and what we expect from you.