Report vulnerabilities privately through GitHub's Report a vulnerability button on the affected repository's Security tab. Do not open public issues for security problems.

contrd controls a container engine and is therefore equivalent to root on the machine it runs on. Reports about its local API (named pipes, Unix sockets, the privileged Linux helper, the engine proxy) have the highest priority.

Only the latest release receives fixes until 1.0.