We take security seriously and appreciate your efforts to responsibly disclose your findings.

Do NOT open a public issue for security vulnerabilities. Instead, please report security issues through one of these channels:

1. GitHub Security Advisories (Preferred): Report via GitHub
2. Email: Send details to security@lanik.us
3. Security Discussions: Open a discussion in our GitHub Discussions
4. Security Issues: Create a Security Advisory on GitHub

When reporting a vulnerability, please include:

• Description: Clear explanation of the security issue
• Steps to Reproduce: Detailed steps to reproduce the vulnerability
• Impact Assessment: Potential impact and affected components
• Proof of Concept: If applicable, a minimal reproduction case
• Suggested Fix: If you have ideas for a fix (optional)

We are committed to responding to security reports in a timely manner:

• Initial Response: Within 48 hours of receiving the report
• Status Update: Within 5 business days with assessment
• Resolution: We will work diligently to fix critical vulnerabilities as quickly as possible

We ask that you:

• Give us reasonable time to investigate and fix the issue before public disclosure
• Do not access, modify, or delete user data
• Do not perform attacks that could harm the availability of our services
• Do not publicly disclose the vulnerability until we have had a chance to address it

This project extracts Docker images to tar files. Security considerations include:

• File System Access: Limited to specified directories and files
• Docker API Security: Uses Docker API with appropriate permissions
• Input Validation: All inputs are validated to prevent path traversal

• Run as Non-root: Use non-root user when possible
• Validate Images: Only extract trusted Docker images
• Monitor Output: Monitor extracted files for suspicious content

When contributing to the project:

• Validate Paths: Ensure all file paths are properly validated
• Test Security: Include security testing in development
• Review Changes: Have security reviews for new features

• Docker Security Best Practices
• GitHub Security Documentation

For general security questions or concerns, you can:

• Open a discussion in our GitHub Discussions
• Contact the maintainers through the security email above for sensitive matters

Thank you for helping keep dfimage secure!