Security fixes are applied to the latest released version of github-platform-operator.

Do not report security vulnerabilities through public GitHub issues.

Use GitHub's private vulnerability reporting feature for this repository when available. Include:

• a clear description
• affected versions
• reproduction steps
• potential impact
• suggested mitigation, when known

Do not include real tokens, Secret values, kubeconfig files, private repository contents or other sensitive data.

The operator needs access to two categories of Kubernetes Secrets:

1. GitHub tokens or GitHub App private keys referenced by GitHubProviderConfig.
2. Values referenced by GitHubActionsSecret and GitHubActionsVariable.

The current controller watches Secrets so that Actions values rotate automatically. Its cluster role therefore includes get, list and watch for Kubernetes Secrets.

Treat installation of the operator as a privileged cluster operation:

• run it in a dedicated namespace
• restrict who can create provider, organization, team and Actions resources
• limit access to the controller service account
• enable Kubernetes Secret encryption at rest
• prefer an external secret manager for production values
• audit changes to deletion policies and provider references

Use the minimum GitHub permissions required for the resources being managed. Prefer short-lived GitHub App installation tokens when practical. Rotate long-lived personal access tokens regularly.

Never place a GitHub token or GitHub App private key directly in a custom resource or Helm values. Reference it through a Kubernetes Secret.

A GitHub App provider exchanges a signed, short-lived JWT for an installation access token. Installation tokens are cached only in process memory and refreshed before expiration. Rotating the referenced private key changes the cache identity and causes a new installation token to be requested.

Limit the GitHub App installation to the required repositories and grant only the repository and organization permissions needed by the managed resources. Protect the PEM Secret at least as strictly as a long-lived token.

GitHubOrganizationMember, GitHubTeam and GitHubTeamMembership require organization-level GitHub permissions. Read-only discovery generally requires Members: read; creating teams, changing roles and revoking membership require Members: write.

Restrict who can create or update these resources. In particular:

• GitHubOrganizationMember with role: admin grants organization-owner access
• GitHubTeamMembership with role: maintainer grants team administration
• Revoke removes remote membership when the Kubernetes resource is deleted
• GitHubTeam with deletionPolicy: Delete deletes the remote team

Use Orphan unless remote cleanup is explicitly required, and review provider scope before granting organization-wide permissions to a GitHub App.

GitHubActionsSecret values are read from Kubernetes, encrypted with GitHub's public key and sent to GitHub. The plaintext value is not stored in custom resource status.

Avoid logging or debugging changes that could print source Secret data.

GitHubActionsVariable also reads from a Kubernetes Secret for a consistent API, but the resulting GitHub variable is not confidential. Never use GitHubActionsVariable for passwords, tokens or private keys.

GitHubRepositoryRuleset can enforce merge, push, deletion and history restrictions. Restrict who can create or update ruleset resources, especially resources using enforcement: active or privileged bypass actors.

Rule parameters are schemaless and are sent to GitHub. Review changes to spec.rules[].parameters as carefully as changes to RBAC or deployment policy.

When a bypass actor uses teamSlug, the controller calls GitHub's team lookup API and therefore needs organization Members: read permission; classic personal access tokens need read:org. Usernames are resolved through GitHub's public user endpoint. Prefer teamSlug and username for maintainability, while retaining actorID for integrations, repository roles, and compatibility with existing manifests.

Remote archival, deletion and access revocation require explicit policies:

Archive
Delete
Revoke

The default is Orphan.

Restrict permission to update or delete the custom resources because a user who can change the deletion policy may trigger destructive GitHub operations.

After a fix is available, maintainers may publish a security advisory describing affected versions, impact and remediation.