The latest GitHub Release is supported. Before the first stable release, security fixes may include compatible hardening changes without a deprecation period.
Use GitHub's private vulnerability reporting for
KanadeK/dishloadout when available. Do not open a public issue containing an
unpatched exploit, private rack data, credentials, or filesystem details.
Include the affected version, operating system, minimal Scenario/Plan input, exact command, observed effect, and why the issue crosses the documented trust boundary. You should receive an acknowledgement within seven days.
Scenario and Plan files are untrusted. DishLoadout limits their size, strictly parses schemas and finite values, escapes generated markup, never evaluates input, never invokes commands from input, and never fetches URLs. Output uses fixed filenames inside a new caller-selected directory.
DishLoadout does not store secrets, run a service, control appliances, or make physical safety claims. A malicious local user who already controls the process working directory or executable is outside the threat model.