Security
Supported revisions and private vulnerability reporting for mm.
mm has no public stable release. Security fixes currently target the latest
main/master revision.
Do not open a public issue for a suspected vulnerability. Report it privately through the GitHub repository security-advisory flow, or through the private contact published with a future release. Include the affected revision, impact, and a reproduction that contains no live secrets.
Reports involving secret disclosure, unmanaged-resource ownership, certificate identity or trust, and reviewed-plan hash bypasses are in scope. Vulnerabilities in Docker, Podman, Swarm, or Ansible themselves should be reported upstream.
Remote transport reports should include the protocol version and redacted request ID, but never private keys, host keys not already public, daemon identity files, payload frames, or target audit records containing private topology.