Where should I report security vulnerabilities with the operator? There is a supply chain vulnerability that gives anybody who can create branches in the https://github.com/fluent/fluent-operator repo (presumably everybody in the fluent GitHub org) the ability to execute arbitrary code in many customer/user environments that the operator is deployed in. It looks like it has existed for several weeks without anybody noticing.

Feel free to reach out to me directly via DM. Thank you!

Can we add a security policy to the repo to cover the correct channels? There's one for the Fluent Bit repo so probably should set up the same for the operator if not already there.

Yeah - good idea.