Stackstead is pre-1.0. Security fixes are applied to the latest published minor release and to the default branch. Older pre-1.0 minors may be asked to upgrade before receiving a fix.

Use the repository's Report a vulnerability button to open a private GitHub Security Advisory. Include the affected version or commit, operating system, runtime provider, reproduction steps, impact, and any proposed mitigation.

Do not open a public issue for an undisclosed vulnerability. If private reporting is unavailable, contact the maintainers through a private channel listed on the repository profile and withhold exploit details until a private channel is established.

We will acknowledge a complete report, reproduce it, assess affected versions, and coordinate disclosure and credit with the reporter. Response timing depends on severity and maintainer availability; this project does not promise a paid bounty or a fixed service-level agreement.

Stackstead prevents accidental runtime-identity collisions and wrong-target cleanup. It is not a hostile-code sandbox, secret manager, multi-user authorization boundary, or Docker-daemon isolation layer. A process launched by Stackstead has the permissions of the invoking user. External networks and volumes, shared host bind mounts, host networking, and services outside the configured runtime can still share state. Stackstead rejects custom name values on managed networks and volumes; see Compose isolation.