Please report security problems privately through GitHub: Security > Report a vulnerability on this repository (https://github.com/EquinoxWN/internal-developer-platform/security/advisories/new). Do not open a public issue.

Include what you found, how to reproduce it, and the impact you expect. You will get an answer within 7 days. Fixes are released as soon as they are ready, and you are credited unless you ask not to be.

This project is pre-1.0. Only the latest commit on main receives fixes.

• In scope: Template inputs that escape validation into generated files, rendered paths outside the output directory, and generated services that ship with unpinned images, root containers or unpinned CI actions.
• Out of scope: Backstage itself, GitHub, and the services teams build from the template afterwards.

• Every GitHub Action is pinned to a full commit SHA, and workflows run with read-only permissions and without persisted credentials.
• Dependabot update pull requests are paused (open-pull-requests-limit: 0) so the repository keeps a single main branch; dependencies are updated by hand and checked by the CI audit.
• CI runs lint, tests and a known-vulnerability check (npm audit) on every push and pull request.