Security fixes are provided for the latest minor release line. Older releases may receive backports at maintainer discretion.

Do not open a public GitHub issue for security vulnerabilities.

Report security issues privately using one of these channels:

1. GitHub private vulnerability reporting (preferred)
2. Email the maintainers at security@hyperbyte.cloud

Include:

• Affected component (server, CLI, proxy, Kubernetes operator)
• HyperbyteDB version or Docker image tag
• Steps to reproduce and expected vs actual behavior
• Impact assessment (confidentiality, integrity, availability)

Severity is assessed by maintainers based on exploitability and data-at-risk.

In scope

• HyperbyteDB server (hyperbytedb binary)
• HyperbyteDB CLI (hyperbytedb-cli)
• HyperbyteDB proxy (hyperbytedb-proxy)
• Kubernetes operator and Helm chart in this repository

Out of scope

• Upstream chDB vulnerabilities (report to chDB maintainers; we will track dependency updates)
• Third-party dependencies not bundled with HyperbyteDB releases
• Deployments with authentication disabled on untrusted networks
• Issues requiring physical access to the host

We follow coordinated disclosure:

1. Reporter submits a private report.
2. Maintainers acknowledge and assign severity.
3. A fix is developed and tested.
4. A GitHub Security Advisory and patched release are published.
5. Public disclosure occurs after users can upgrade (typically within 7 days of the patch release).

Reporters may be credited in the advisory unless they request anonymity.

• Enable [auth] in production and restrict network access to admin routes.
• Use TLS (server.tls_enabled) when traffic crosses untrusted networks.
• Keep Docker images and release tarballs updated to the latest patch release.
• Review Authentication and Administration before exposing cluster endpoints.