Trust
Coordinated disclosures and hardening notes. We publish when fixes are available or by mutual agreement.
Improper audience checks allowed forged tokens to be accepted across tenants. Rotate secrets, enforce audience, and re-issue sessions.
Chained deserialization and path traversal enabled code execution under service account. Patch 3.4.2 or disable converter.
Untrusted env passed to setuid helper. Remove setuid bit or upgrade to 2.10.1 where helper drops unsafe env.
Wildcard actions allowed cross-account writes. Scope actions, apply bucket policies, and rotate credentials.