Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting so the report, reproduction steps, and any proposed fix remain private.

Include the affected version and macOS version, the impact, and the smallest reproduction you can provide. Kuvo Box's logs can contain container names, image names, and paths from your Mac, so remove anything identifying from logs and screenshots before you share them.

You should receive an acknowledgement within seven days. Confirmed issues will be coordinated privately until a fix and release are available.

Reports are especially welcome about:

• the boundary between the Linux VM and the Mac, including the shared /Users folder and the Docker socket at ~/.kuvo/docker.sock;
• ports forwarded to localhost;
• the downloads and checksums Kuvo Box uses to set up its VM;
• software updates: the update feed, its signatures and how they're checked;
• the kuvo command and the PATH changes Kuvo Box makes.

Vulnerabilities in Docker Engine or Alpine Linux themselves should go to those projects. Tell us too if Kuvo Box's setup makes one easier to exploit.

Kuvo Box is pre-1.0. Security fixes are made on main and released in the newest build; older builds are not maintained separately.