Only the latest release receives security fixes. The upstream project gives no longer support period; vendors that ship Keystone own theirs. See the support policy.

Do not open a public issue for a security problem.

Report it privately with GitHub private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability.

Please include the affected version, a description, steps to reproduce and the impact you see.

• We acknowledge your report within 3 days.
• We triage it within 7 days and tell you whether we accept it.
• We prepare the fix privately and coordinate the disclosure date with you.
• After the fix is released we publish a GitHub Security Advisory with a CVE request and announce it in the Security announcements category of GitHub Discussions.

If you ship or sell a build of Keystone, read the cybersecurity policy and the Art. 14 reporting runbook.