Security: pulp/pulp-openapi-generator

Security

SECURITY.md

Note

This is a possibly outdated copy. The real document always taking precedence is here: https://github.com/pulp/governance

Pulp Security Policy

Goal

This document defines the official Security Policy for The Pulp Project.

Commitment

This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).

Red Hat takes security seriously. Red Hat is committed to maintaining the highest level of security and trust for all users. Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.

Contact: cra-steward@redhat.com

Scope

  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects

Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.

Reporting a vulnerability

All reports MUST be submitted by email to: pulp-security@redhat.com

Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.

Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.

Incident response

A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack. This is distinct from a vulnerability report (a flaw in code) and requires operational response.

The response steps are:

  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted

Security Policy Hierarchy

The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository. Having this file ensures high visibility and automatic integration with GitHub's security features.

Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository. The SECURITY.md file MAY be a copy of this policy. If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.

Policy governance

This policy may be updated periodically. Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.

Notes

The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: pulp/pulp-openapi-generator
Security

SECURITY.md

Note
This is a possibly outdated copy. The real document always taking precedence is here:
https://github.com/pulp/governance
Pulp Security Policy
Goal
This document defines the official Security Policy for The Pulp Project.
Commitment
This project is stewarded by Red Hat, Inc., an open-source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847).
Red Hat takes security seriously.
Red Hat is committed to maintaining the highest level of security and trust for all users.
Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
Contact: cra-steward@redhat.com
Scope
  • Pulp Core (pulpcore)
  • All maintained plugins under the Pulp GitHub organization
    • Includes plugins maintained by the core Red Hat team and community maintainers
  • All contributors, maintainers, committers, and security researchers interacting with these projects
Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
Reporting a vulnerability
All reports MUST be submitted by email to: pulp-security@redhat.com
Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
Please refer to the Vulnerability Management Policy for full details on how to report a vulnerability.
Incident response
A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
This is distinct from a vulnerability report (a flaw in code) and requires operational response.
The response steps are:
  1. Contain: Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
  2. Assess: Determine the scope, impact, and root cause of the incident
  3. Remediate: Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
  4. Communicate: Notify affected parties. For incidents affecting released artifacts, issue a public advisory
  5. Post-mortem: Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
Security Policy Hierarchy
The SECURITY.md file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
Having this file ensures high visibility and automatic integration with GitHub's security features.
Each project SHOULD host a SECURITY.md file in the root directory of their GitHub repository.
The SECURITY.md file MAY be a copy of this policy.
If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
Policy governance
This policy may be updated periodically.
Suggestions for improvement can be submitted through issues or pull requests to the pulp/governance repository.
Notes
The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in RFC 2119.
 There aren't any published security advisories