Only the latest release on the current major version line receives security updates.

Do not open a public issue for security vulnerabilities.

Please report vulnerabilities privately through GitHub Security Advisories.

1. Go to the Security Advisories page
2. Click "New draft security advisory"
3. Fill in a description of the vulnerability, including steps to reproduce if possible

• Acknowledgment: Within 48 hours of your report
• Initial assessment: Within 7 days
• Fix or mitigation: Within 30 days for confirmed vulnerabilities

We will keep you informed of progress throughout the process.

Documented, accepted for V1:

• Single bearer token. No rotation, no expiry, no revocation. Loss of WARREN_API_TOKEN = full access. Mitigation: rotate by editing .env / the cluster secret and bouncing the container.
• Plaintext secrets in .env. Standard for self-host. The operator owns filesystem perms (chmod 600 .env). On a cluster, a managed secret store (Kubernetes Secrets / cloud secret manager) encrypts at rest.
• No HTTPS termination in warren. TLS is the reverse proxy's job. Direct HTTP on a non-loopback address is a misconfiguration, and warren doctor warns.
• Trust-the-socket between warren and burrow. Burrow's unix socket has no auth. The in-container threat model is "warren is the only client." A third party with code execution inside the warren process has full burrow access. Warren and burrow share the container by design.
• No CSRF protection on the UI. UI calls warren's API with the bearer token. Not exposed to third-party origins (CORS strict). Single-user posture.
• Path-mode previews run on their own origin — publish the preview port. WARREN_PREVIEW_MODE=path is the default. Warren serves each preview app from a dedicated listener on WARREN_PREVIEW_PORT (warren-3f8a, default: bind port + 1). Each preview gets its own browser origin. The operator bearer token lives in localStorage on the warren UI origin. Same-origin policy blocks agent-authored preview code from that storage. The warren origin answers /p/<run-id>/ with a 308 to the preview origin. The proxy still strips Authorization and Cookie before it forwards a request upstream. Publish the preview port next to the API port. docker-compose maps both. A reverse proxy needs a second forwarded port on the same hostname. The unix-socket transport has no TCP port to bind. It keeps the old same-origin mounting and warns at boot. On that topology, set WARREN_PREVIEW_MODE=subdomain for previews that run untrusted code.

• No multi-tenant auth, no per-user RBAC in V1. Single bearer token, one user. Multi-user identity via OIDC is on the post-V1 roadmap (R-09).
• No audit log in V1. Warren plans an append-only dispatch/steer/cancel/secret-read ledger post-V1 (R-16). It lands alongside R-09 since it depends on real user identity.
• No GitHub App auth in V1 — shared PAT via GITHUB_TOKEN. Warren plans GitHub App auth with installation-scoped tokens and per-repo allowlists post-V1 (R-18).

These are limitations for V1, not bugs. V2 candidates: token-pair (read/write), per-token scopes, audit log.

If you find a vulnerability outside this list, report it through the process above and we'll triage it.