We take security issues seriously. Please report a security vulnerability to the maintainers using private vulnerability reporting.
If you can't use GitHub, email the security contact at jose.amengual@gmail.com.
Configuration for Anthropic's OSS Scanner is in .oss-scanner/: a Dockerfile that builds Atlantis and runs its tests offline, and the threat model that scopes what gets reported. Update the threat model when a change moves a trust boundary.
Only the two latest minor releases are maintained. For example, if 0.29.7 is the latest, then 0.29.x and 0.28.x will receive security fixes.