| Version | Supported |
|---|---|
v1.0.1 (latest) |
yes |
v1.0.0 |
yes |
v0.3.7 |
yes |
v0.3.6 |
yes |
v0.3.5 |
yes |
v0.3.4 |
yes |
v0.3.3 |
yes |
v0.3.2 |
yes |
v0.3.1 |
yes |
v0.3.0 |
yes |
v0.2.11 |
yes |
v0.2.10 |
yes |
v0.2.9 |
yes |
v0.2.8 |
yes |
v0.2.7 |
yes |
v0.2.6 |
yes |
v0.2.5 |
yes |
v0.2.4 |
yes |
v0.2.3 |
no — upgrade (host listener and dev.sh fallback hardening; see CHANGELOG) |
v0.2.2, v0.2.1 |
yes |
v0.2.0 |
no — upgrade (mesh agent forwarding, root-owned skill directories; see CHANGELOG) |
v0.1.6 |
yes |
v0.1.5 |
no — upgrade (no code security fix since; newer editor pin) |
v0.1.4 |
no — upgrade (no code security fix since; newer editor pin) |
v0.1.3 |
no — upgrade (no code security fix since; newer editor pin) |
v0.1.2 |
no — upgrade (no code security fix since; newer editor pin and doctor fix) |
v0.1.1 |
no — upgrade (the agents layer cannot install npm-based CLIs) |
v0.1.0 |
no — upgrade (security fixes in v0.1.1) |
Fixes land on main and ship in the next patch release; while the project is at 0.x,
the latest release and the one before it receive security fixes.
Please report privately — never in a public issue, discussion or pull request:
- GitHub: Security → Report a vulnerability on DailybotHQ/devcontainer-kit (private vulnerability reporting), or
- e-mail: security@dailybot.com.
Include the version (dck --version), the host OS and Docker runtime (dck doctor --json
helps — it never prints secret values), and the steps to reproduce.
| Step | Target |
|---|---|
| Acknowledgement | within 3 business days |
| First assessment (severity, affected versions) | within 7 business days |
| Fix or mitigation for high/critical issues | within 30 days, coordinated with you |
| Public advisory | when a fixed release is available, crediting you unless you prefer otherwise |
The threat model, trust boundaries and the defaults this project enforces (loopback-only
ports, SSH agent forwarding instead of key copies, runtime host keys, pinned and
checksum-verified images, --trust for host-reaching repository configuration — including
files given with --compose-file) and the opt-ins that widen them on purpose (the host
listener, [agents] host_profiles, [ssh] copy_keys, all host-profile only) are
documented in docs/SECURITY.md.