Skip to main content

​
Reporting

Report suspected vulnerabilities privately through GitHub’s security advisory process:
github.com/datris/datris-platform-oss/security/advisories/new
Please do not open a public issue for a security report. If you cannot use GitHub, email info@datris.ai with the same detail you would put in an advisory: affected version, component, reproduction steps, and impact.

​
Response targets

​
Advisories

Fixed vulnerabilities are published as GitHub Security Advisories on the repository and summarized in the changelog with impact described in general terms. Deployments that register with Datris.ai and commercial licensees receive advisories ahead of public disclosure.

​
SBOM and scanning

  • SBOM. Every release publishes a CycloneDX software bill of materials for each of the four container images (server, UI, MCP server, tap runner), generated by Syft and attached to the release’s docker-publish workflow run on GitHub.
  • Dependency scanning. Trivy runs on every pull request and push to main and fails the build on new HIGH or CRITICAL findings with an available fix. Published images are re-scanned weekly for OS-package CVEs. Dependabot security updates cover GitHub Actions, npm, pip, and Docker base images; JVM dependencies are covered through the GitHub dependency graph.
  • Secret scanning and push protection are enabled on the repository.
  • Security Architecture — the model these controls sit in
  • The repository’s SECURITY.md is the canonical statement of this policy.