Security
Found a vulnerability? Report it privately.
Light WAF is a security product, so a way to get an attack past it is a vulnerability too. Don't open a public issue for a detection bypass or a flaw in the proxy, control plane, agent or operator — use GitHub's private vulnerability reporting. The security policy explains the scope and what to expect.
Supply chain. GitHub Actions pinned to commit SHAs and image bases to digests, kept fresh by Dependabot; CodeQL and fuzzing on every change; every container image gated on a vulnerability scan and signed with Sigstore, release assets with SLSA provenance. The repository's practices are graded continuously by OpenSSF Scorecard, and the project meets the OpenSSF Best Practices criteria.