Cluvia handles cluster credentials (client certificates, tokens, credential plugins) and edits kubeconfig files, so security reports are taken seriously.

Security fixes go into the latest release. Please update before reporting.

Please do not open a public issue. Instead, use GitHub private vulnerability reporting, or email levanlong220700@gmail.com with:

• what you found and its impact,
• steps to reproduce (a minimal kubeconfig with secrets removed, if relevant),
• the Cluvia and macOS versions.

You will get an acknowledgement within a few days. Once a fix is released, the advisory is published with credit to you unless you prefer otherwise.