Security fixes are provided for the latest released minor version. Pre-release code on main receives fixes but carries no compatibility guarantee.

Do not open a public issue. Use GitHub's private vulnerability reporting / Security Advisory flow for this repository and include:

• affected version or commit;
• reproducible steps and required cluster configuration;
• impact, including whether node-local data or cluster-wide RBAC is involved;
• any proposed mitigation.

Maintainers target acknowledging a complete report within 48 hours, coordinate validation and remediation privately, and credit reporters who want attribution. Avoid accessing data that is not yours and do not publish details before a fix and disclosure timeline are agreed.

local-rwx is designed for trusted Kubernetes clusters. It uses sec=sys, local host storage, cluster-scoped provisioning RBAC, and a Pod Security exemption for the NFS-server namespace. It does not provide tenant authentication, encrypted NFS transport, replication, or protection from a compromised node. See docs/security.md and docs/risks.md before production use.