If you discover a security vulnerability in this project, please report it responsibly.
Do NOT open a public GitHub issue for security vulnerabilities.
For vulnerabilities affecting Red Hat OpenShift AI (RHOAI) deployments:
For vulnerabilities in the upstream open source project:
- GitHub: Use GitHub Security Advisories to report privately
- Acknowledgement: Within 3 business days
- Initial assessment: Within 7 business days
- Fix timeline: Depends on severity; critical issues are prioritized
| Version | Supported |
|---|---|
| main branch | Yes |
| Released tags | Yes |
This project employs:
- Static analysis: Bandit (Python security linter) and Ruff
- Dependency scanning: Dependabot, Trivy container scanning
- Type checking: Pyrefly
- Secret detection: detect-secrets, gitleaks
- Container hardening: UBI minimal base image, non-root user, FIPS-compatible crypto policy