Security fixes are released for the latest tagged version of onctl only. Please upgrade to the latest release before reporting an issue.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report them privately through GitHub's private vulnerability reporting.

Include as much of the following as you can:

• the onctl version (onctl version) and the cloud provider involved
• steps to reproduce, or a proof of concept
• the impact you expect an attacker could achieve

• An acknowledgement of your report within 7 days.
• An assessment and, if the report is accepted, a fix in a new release. You will be credited in the advisory unless you prefer otherwise.
• Coordinated disclosure: please give us a reasonable chance to release a fix before making the issue public.