Please do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting: the repository's Security tab → Report a vulnerability. The report is visible only to you and the repository's maintainers until an advisory is published.

A useful report says:

• which component is affected — the kubescrape metadata service, the kubescrape-agent DaemonSet, the events/Azure singleton, the trace tier, the Helm chart, or one of the importable pkg/ packages — and the commit it was found on;
• what can reach it: which listener, route or input, and whether it needs a credential (several listeners are unauthenticated by design, see below);
• how to reproduce it, and what it lets an attacker do.

Some holes are deliberately left open, each with its reason and what an operator can do about it — the unauthenticated OTLP ingest listeners among them. They are listed in Accepted security residuals. A report showing that one of them is worse than that section says is welcome.

Only the latest release is supported. Fixes land on main and ship in the next release; there are no backports to older ones.

CI runs govulncheck over the shipped build tags on every push to main and every pull request (make vulncheck), and the Go toolchain floor in go.mod is set by the standard-library advisories that check found (Toolchain and build floor).