There is no supported PastureStack release yet. 0.7.1 is an unpublished candidate and must not enter a catalog until its source, image, and Kubernetes 1.12.10 integration gates have passed at the exact candidate commit.

• Platform events and Kubernetes objects can contain sensitive topology; do not log complete payloads.
• API keys, kubeconfigs, service-account tokens, certificates, private endpoints, and live metadata must never be committed.
• Preserve bounded health listeners and avoid sharing the default HTTP mux.
• A mounted CA is parsed and selected without modifying the system trust store; an explicitly configured SSL_CERT_FILE always wins.
• The runtime is distroless, contains no shell or package manager, and runs as UID/GID 65532.
• The build fails on reachable Go vulnerabilities and applicable Critical/High runtime findings.
• Raw build-environment findings remain in the evidence bundle. A reviewed OpenVEX document filters only kernel-runtime findings attributed to the header-only linux-libc-dev build dependency; both raw and applicable reports are retained.

Report suspected vulnerabilities through this repository's private security advisory channel. Do not include live credentials or cluster data in a public issue.