We take the security of rune very seriously.

RUNE is currently in pre-alpha development and is not intended for production use.

Note: During the pre-alpha phase, "best-effort" means vulnerabilities are triaged and addressed as fast as practically possible given a solo-maintainer context, but there are no guaranteed SLA timelines. Security researchers are encouraged to report all findings — see the Reporting section.

To identify the exact version of rune you are running:

rune --version
# Output: rune-bench 0.0.0a5

For rune-operator and rune-ui (deployed via Helm):

helm list -n <namespace>
kubectl get deployment rune-operator -n <namespace> \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

If you discover a security vulnerability within rune, please do not open a public issue.

Instead, please send an e-mail to [luca@bucaniere.us].

All security vulnerabilities will be promptly addressed. We will try to get back to you within 48 hours to acknowledge the report and briefly detail how and when we plan to address it.

Once the vulnerability is resolved, a security advisory will be published, and you will be credited for the discovery if you so choose.

The repository must enforce branch protection on target branches (main, develop) so pull requests cannot be merged when checks fail.

Required policy:

• Require status checks to pass before merging.
• Mark Merge Gate as a required status check.
• Do not allow bypassing required checks for regular contributors.

Security policy gate in CI:

• SBOM is generated and scanned by multiple scanners.
• If any fixable vulnerability has CVSS score > 8.8, CI fails and PR merge is blocked.
• Because Merge Gate is required, PR merge is blocked when CVSS > 8.8 is detected.

The project aims to close all known vulnerabilities, not just those above the CVSS 8.8 threshold.