Skip to content
Celum

Security and vulnerability disclosure

Last updated: 25 September 2026

If you have found a security vulnerability in Celum, we want to hear about it, and we would rather hear it from you than read about it. This page sets out what is in scope, how to report, what we commit to in return, and how we disclose what we fix. It follows coordinated vulnerability disclosure, as the EU Cyber Resilience Act expects of manufacturers.

Scope

This policy covers Celum: the console and its API, the agent and configuration Celum installs on a supervisor, and the documentation site. Reports about this marketing site are welcome too, and are handled at a lower priority.

  • In scope: the Celum console and API, what Celum installs on a supervisor, and how Celum handles credentials for the clusters it manages.
  • Upstream projects such as Talos, Cluster API, Cilium, KubeVirt and Rook-Ceph have their own disclosure processes — report to them directly. If you are not sure whether an issue is ours or theirs, send it to us and we will help route it.
  • Out of scope: findings that need physical access, social engineering of our staff, and denial of service.

How to report

Email the address at the bottom of this page. A useful report includes:

  • The Celum version and the component affected
  • Steps to reproduce, or a proof of concept
  • What an attacker could do with it, as you understand it
  • How you would like to be credited, if at all

What we commit to

Once your report arrives:

  • We acknowledge it and tell you who is handling it.
  • We keep you informed as we confirm the issue, fix it and release the fix.
  • We credit you in the published advisory, unless you ask us not to.

Safe harbour

We will not pursue legal action against research carried out in good faith under this policy. Good faith means:

  • Accessing only as much data as you need to demonstrate the issue, and not keeping it
  • No denial of service, and nothing that degrades the service for other people
  • Not accessing or changing data that belongs to anyone else
  • Giving us a reasonable chance to fix the issue before you disclose it

Coordinated disclosure

We disclose in coordination with the reporter. Once a fix is released we publish an advisory, and we agree the timing with you rather than holding a report indefinitely.

Security updates and support period

Security fixes for a supported version of Celum are provided free of charge, as the Cyber Resilience Act requires.

Where fixed vulnerabilities are published

Every fixed vulnerability gets a public advisory stating what was affected, which version fixes it, and who reported it.

They are listed under security advisories.

Report a vulnerability

Email security@celum.io with the details above. Please do not open a public issue or post about it before we have had a chance to fix it.