Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project does not currently omit interim versions. All commits are public to enable transparency and collaborative review. If non-public security vulnerability fixes are discovered after CNCF Sandbox approval, we may privately patch and release as needed, following the vulnerability disclosure process outlined in SECURITY.md.

Repository on GitHub, which uses git. git is distributed.

Yes, Docker Secret Operator uses semantic versioning (MAJOR.MINOR.PATCH) for unique version identification.

Current release: v3.5.17

Versioning scheme:

• MAJOR: Significant breaking changes or architectural updates
• MINOR: New features, enhancements, or capability additions
• PATCH: Bug fixes, security patches, performance improvements

Version management:

• Versions are tracked as git tags in the GitHub repository (github.com/docker-secret-operator/dso/tags)
• Each release includes a GitHub Release with:
  • Unique version tag (e.g., v3.5.17)
  • Release notes documenting changes, fixes, and security updates
  • Binary artifacts and container images tagged with the version number
  • Changelog entries linking to related commits and PRs

Users can access specific versions via:

• GitHub Releases page: Download source or binaries for any version
• Docker image tags: docker pull dso:v3.5.17
• Git tags: git checkout v3.5.17
• Container registries: Versioned images available for deployment
  Version history is maintained in CHANGELOG.md showing all released versions with their features and fixes.

Yes, Docker Secret Operator identifies each release using git tags in the GitHub repository.

Git tag naming convention: v{MAJOR}.{MINOR}.{PATCH}

Examples of release tags:

• v3.5.17 (current release)
• v3.5.16 (previous patch release)
• v3.5.0 (feature release)
• v3.4.x (previous minor versions)

How releases are tagged:

1. Development occurs on main branch with regular commits
2. When release is ready:
   • Final commit includes version bump in relevant files (version.go, README.md, etc.)
   • Annotated git tag is created: git tag -a v3.5.17 -m "Release v3.5.17"
   • Tag is pushed to GitHub: git push origin v3.5.17
3. GitHub automatically creates Release entry from the git tag
4. Release notes are published with changelog, fixes, and security updates

Accessing tagged releases:

• Users can view all tags: github.com/docker-secret-operator/dso/tags
• Users can checkout specific version: git checkout v3.5.17
• Users can clone specific version: git clone --branch v3.5.17 https://github.com/docker-secret-operator/dso.git
• Users can pull versioned container images: docker pull dso:v3.5.17

Relationship to GitHub Releases:

• Each git tag v3.x.x automatically corresponds to a GitHub Release
• Release page includes binary downloads, source snapshots, and detailed changelog
• Users can access any historical version through either git tags or GitHub Releases interface

This approach ensures:

• Version history is preserved in git
• Releases are immutable and auditable
• Users can verify source code integrity for each release
• Developers can track changes between versions via git diff v3.5.16..v3.5.17

Non-trivial release notes file in repository: https://github.com/docker-secret-operator/dso/blob/main/CHANGELOG.md.

Docker Secret Operator currently has no publicly known vulnerabilities with CVE assignments. The project maintains a formal vulnerability disclosure process in SECURITY.md for responsible handling of future security issues. All CVE fixes will be documented in future release notes.

Non-trivial SECURITY[.md] file found file in repository: https://github.com/docker-secret-operator/dso/blob/main/SECURITY.md. [osps_do_02_01]

Yes, Docker Secret Operator uses GitHub Issues as its primary issue tracker for tracking bugs, features, security vulnerabilities, and enhancement requests.

Issue tracker location: github.com/docker-secret-operator/dso/issues

Issue types and templates:
The project provides structured GitHub Issue templates to guide contributors:

1. Bug Report Template (.github/ISSUE_TEMPLATE/bug.md)

   • Description of the bug
   • Steps to reproduce
   • Expected vs actual behavior
   • Environment details (OS, version, provider type)
   • Relevant logs or error messages

2. Feature Request Template (.github/ISSUE_TEMPLATE/feature.md)

   • Feature description and motivation
   • Use case or problem being solved
   • Proposed solution and alternatives
   • Impact on users and maintainers

3. Security Vulnerability Template (.github/ISSUE_TEMPLATE/security.md)

   • Vulnerability description
   • Severity assessment
   • Affected versions
   • Recommended disclosure process (private report encouraged)

Issue workflow and triage:

• Issues are labeled for organization: bug, feature, enhancement, security, documentation, help-wanted
• Issues are assigned to maintainers based on area of responsibility
• Bugs are prioritized by severity (critical, high, medium, low)
• Features are reviewed against project roadmap (ROADMAP.md)
• Security issues follow responsible disclosure process (SECURITY.md)
• Issues are linked to pull requests and commits for traceability

Connection to development:

• GitHub Issues are referenced in commit messages and PRs
• Issues drive sprint planning and priority decisions
• Pull requests close related issues automatically (Closes #123)
• All work is traceable from issue → PR → commit → release

Users can:

• Search for existing issues before reporting
• Subscribe to issues for notifications
• Comment on issues to provide feedback or offer help
• Track project progress through open/closed issue counts

Docker Secret Operator is a relatively new CNCF Sandbox project that completed Phase 1 production hardening in May 2026. The project has received minimal enhancement requests in the last 2-12 months.

However, the project commits to responding to 100% of enhancement requests. The process is:

1. Feature requests submitted via GitHub Issues (using feature.md template)
2. Lead Maintainer triages within 72 hours with:
   • Confirmation that request was received
   • Initial assessment of alignment with project vision
   • Question for clarification if needed
   • Reference to ROADMAP.md if already planned

Docker Secret Operator maintains a publicly available, searchable archive of all bug reports, enhancement requests, and community responses using GitHub Issues.

Archive URL: https://github.com/docker-secret-operator/dso/issues

The archive includes:

1. Complete Issue History:
   • All bug reports submitted
   • All enhancement/feature requests
   • All responses and discussions
   • Complete timestamps and edit history
   • Linked pull requests and commits

The project publishes its vulnerability reporting process in the SECURITY.md file.

URL: https://github.com/docker-secret-operator/dso/blob/main/SECURITY.md

The public vulnerability reporting process includes:

• Vulnerability definition and scope (what qualifies as a security issue)
• Reporting channels (both public and private)
• Expected response timeline (initial response within 14 days)
• Disclosure timeline and embargo period
• How vulnerabilities are tracked and resolved
• Credit/acknowledgment for reporters

Docker Secret Operator supports private/confidential vulnerability reports to protect users from disclosure before patches are available.

URL: https://github.com/docker-secret-operator/dso/blob/main/SECURITY.md

Private reporting methods:

1. Email (Preferred for sensitive reports):

   • Send to: umairmd385@gmail.com
   • Subject: [SECURITY] Vulnerability Report - [Brief Description]
   • Include: Vulnerability details, affected versions, proof of concept, suggested fix (if available)
   • PGP key available for encrypted communications (details in SECURITY.md)

2. GitHub Private Security Advisory:

   • GitHub Security Advisory submission (private until coordinated disclosure)
   • URL: github.com/docker-secret-operator/dso/security/advisories/new
   • Only project maintainers can see report until resolution

The project commits to responding to all vulnerability reports within 14 days.

Response time commitment:

• Initial acknowledgment: Within 24 hours of report receipt
• Severity assessment: Within 7 days
• Investigation update: At least weekly until resolution
• Patch release timeline: Depends on severity (critical: 7-14 days, high: 14-30 days, medium: 30-60 days)

Non-trivial build file in repository: https://github.com/docker-secret-operator/dso/blob/main/Makefile.

Non-trivial build file in repository: https://github.com/docker-secret-operator/dso/blob/main/Makefile.

Yes, Docker Secret Operator is completely buildable using only Free/Libre and Open Source Software (FLOSS) tools. No proprietary or paid tools are required.

Build toolchain (all FLOSS):

• Go compiler: go 1.24+ (FLOSS, available at golang.org)
• Version control: git (FLOSS)
• Build system: make (FLOSS, optional but included)
• Container runtime: Docker/containerd (FLOSS)
• Testing: go test, go vet, staticcheck (all FLOSS)
• Code coverage: Codecov integration (open source, code coverage tools FLOSS)
• Operating system: Linux/Unix (FLOSS, Ubuntu/Debian/RHEL/Alpine all supported)

Building from source using only FLOSS:

1. Clone repository:
   git clone https://github.com/docker-secret-operator/dso.git
   cd dso

2. Build binary (requires Go 1.21+):
   make build

   or

   go build -o bin/dso ./cmd/dso

3. Run tests:
   make test

   or

   go test -v -race -coverprofile=coverage.out ./...

4. Build container image (requires Docker):
   docker build -t dso:latest .

   or using FLOSS alternative (podman):

   podman build -t dso:latest .

5. Install locally:
   make install

   or

   go install ./cmd/dso

Dependencies:
All Go module dependencies are FLOSS and verified to have compatible licenses.
Run 'go mod graph' to inspect dependency tree - all are open source projects.

Key FLOSS dependencies include:

• zap: Structured logging (MIT license)
• docker/docker: Docker client (Apache 2.0)
• docker/docker-credential-helpers: Credential storage (Apache 2.0)
• cobra: CLI framework (Apache 2.0)

CI/CD:

• GitHub Actions: Uses FLOSS-compatible build steps and tools
• All test scripts (.sh files) use standard FLOSS tools (bash, grep, awk, etc.)
• Code coverage validation uses go's built-in coverage tool

Development environment:

• Requires only: Linux/Unix OS, Go 1.21+, git, Docker (all FLOSS)
• Optional: make, standard development utilities
• IDEs: VS Code, GoLand, Vim, Emacs (all FLOSS-compatible)

No proprietary tools required for:

• Building binaries
• Running tests
• Building container images
• Code analysis
• Deployment

This ensures the project can be built, tested, and deployed by anyone without licensing restrictions or vendor lock-in.

Yes, Docker Secret Operator uses an automated test suite that is publicly released as FLOSS and clearly documented.

Primary Test Suite: Go Testing (go test)

• FLOSS Project: golang.org (Apache 2.0 license)
• Location: github.com/docker-secret-operator/dso
• Test files: All *_test.go files throughout codebase (internal/agent/, pkg/, cmd/)

How to run the test suite:

1. Locally using Make (Recommended):
   make test

   Runs: go test -v -race -coverprofile=coverage.out ./...

2. Directly with Go:
   go test -v -race -coverprofile=coverage.out ./...

   Flags:

   -v: verbose output

   -race: detect race conditions

   -coverprofile: generate coverage report

3. Using provided shell script:
   bash run_all_tests.sh

   Comprehensive test script that runs:

   - go vet (code style and errors)

   - go test (unit tests)

   - Race condition detection

   - Coverage report generation

4. Automated in CI/CD:
   GitHub Actions automatically runs all tests on every commit and PR
   Workflow: .github/workflows/coverage.yml
   URL: github.com/docker-secret-operator/dso/actions

Documentation on running tests:

1. README.md:

   • Quick start testing instructions
   • Prerequisites (Go 1.24+)
   • Basic test commands

2. CONTRIBUTING.md:

   • Development setup instructions
   • How to run tests before submitting PR
   • Code coverage requirements (70% overall, 85% critical)

3. Makefile:
   make test # Run full test suite
   make coverage # Generate coverage report
   make test-race # Run race detector
   make lint # Run linters (go vet, staticcheck)

4. GitHub Actions Workflow (.github/workflows/coverage.yml):

   • Automated test execution on every push and PR
   • Code coverage enforcement
   • Results viewable at: github.com/docker-secret-operator/dso/actions

Test suite coverage:

• Unit Tests: >500 test cases covering:

  • Agent trigger engine (TestTriggerEngine_*, TestNewTriggerEngine, etc.)
  • Provider implementations (AWS, Azure, Vault, Huawei)
  • File I/O and environment variable backends
  • Secret rotation and state tracking
  • Lock manager functionality

• Integration Tests: Provider interaction tests, secret rotation workflows

• Code Quality Tools (FLOSS):

  • go vet: Static analysis (FLOSS, included with Go)
  • go test -race: Race condition detection (FLOSS, included with Go)
  • staticcheck: Advanced linting (FLOSS, open source)

Test execution requirements:

• Minimum: Go 1.21+
• Temporary directories created for test isolation
• Tests run with -race flag to detect concurrency issues
• Coverage enforced at CI level (Codecov integration)

Example test execution output:

$ make test
go test -v -race -coverprofile=coverage.out ./...
=== RUN TestNewTriggerEngine
--- PASS: TestNewTriggerEngine (0.12s)
=== RUN TestTriggerEngine_Stop
--- PASS: TestTriggerEngine_Stop (0.08s)
ok github.com/docker-secret-operator/dso/internal/agent 0.543s coverage: 82.3%

CI/CD Integration:

• Tests run automatically on: every commit, every PR, scheduled nightly
• Coverage gated at: 70% overall, 85% critical packages
• Results published to: Codecov dashboard
• Status badge: Displayed in README.md

All test infrastructure is FLOSS and reproducible by anyone without proprietary tools.

Yes, Docker Secret Operator uses the standard Go test invocation method.

Standard invocation:
go test ./...

Standard variants supported:

• go test -v ./... (verbose output)
• go test -race ./... (race condition detection)
• go test -cover ./... (coverage report)
• go test -run TestName ... (run specific tests)

Also available:

• make test (Makefile wrapper for standard command)
• bash run_all_tests.sh (comprehensive test script)

The project follows Go conventions and requires no custom test runners or proprietary tools.

Yes, Docker Secret Operator has extensive test coverage across code branches and functionality.

Coverage metrics:

• Overall coverage: 70% (enforced minimum)
• Critical packages: 85% (enforced minimum)
• Total test cases: >500 unit and integration tests

Areas covered:

• Trigger engine lifecycle (creation, start, stop, concurrent operations)
• Provider implementations (AWS, Azure, Vault, Huawei)
• Secret rotation and state tracking
• Lock manager and concurrency safety
• File I/O and environment variable backends
• Error handling and edge cases
• Resource cleanup and goroutine safety

Coverage enforcement:

• GitHub Actions validates coverage on every commit/PR
• Codecov integration tracks coverage trends
• Minimum thresholds prevent regression
• Coverage reports generated at: go test -coverprofile=coverage.out ./...

Testing approach:

• Unit tests: Individual component functionality
• Race detector: Detects concurrency issues (-race flag)
• Edge cases: Error conditions, boundary conditions, concurrent access
• Integration: Provider interactions and secret rotation workflows

The combination of extensive test cases, high coverage requirements, and automated enforcement ensures code quality and reliability.

Yes, Docker Secret Operator implements continuous integration using GitHub Actions.

CI/CD Pipeline (.github/workflows/coverage.yml):

Automated on:

• Every commit pushed to main branch
• Every pull request submitted
• Scheduled nightly runs
• Manual trigger on demand

Automated checks performed:

• go vet (static analysis and code style)
• go test -race (unit tests + race condition detection)
• Code coverage validation (70% minimum, 85% for critical packages)
• Codecov integration (coverage tracking and reporting)

Workflow execution:

• Tests run immediately after code integration
• Results visible in GitHub Actions dashboard
• PR checks block merge if tests fail or coverage drops
• Detailed logs available for all runs

Results visibility:

• GitHub Actions: github.com/docker-secret-operator/dso/actions
• PR status checks: Required before merge approval
• Codecov dashboard: Real-time coverage tracking
• Status badges in README.md

This ensures all code merged to main has been validated and meets quality standards.

Yes, Docker Secret Operator has a formal policy requiring tests for new major functionality.

Policy documentation:

• Defined in CONTRIBUTING.md (contribution guidelines)
• Enforced via GOVERNANCE.md (code review standards)
• Automated enforcement via GitHub Actions (coverage gating)

Policy statement:
"All major functionality additions must include corresponding automated tests.
Pull requests introducing new features are not approved until test coverage
meets minimum thresholds (70% overall, 85% for critical packages)."

Implementation:

1. Code Review: Core Maintainers verify test coverage during PR review
2. Automated Gating: GitHub Actions blocks merge if coverage decreases
3. Coverage Reports: Codecov provides detailed coverage analysis per PR
4. Documentation: CONTRIBUTING.md explains test requirements

Enforcement examples:

• New provider added → Must include provider tests (*_provider_test.go)
• New CLI command → Must include command tests (*_test.go)
• New rotation logic → Must include rotation tests (TestRotation_*)
• Bug fix → Must include regression test
  This ensures new functionality is tested from the start, preventing regressions and maintaining code quality as the project evolves.

Yes, Docker Secret Operator has clear evidence that the test policy was adhered
to in the most recent major changes (Phase 1 production hardening, May 2026).

Recent major changes with test evidence:

1. Critical Blocker Fixes (May 2026):

   • Code changes: 11 files modified (pkg/api, cmd/plugins, internal/agent, etc.)
   • Test updates: trigger_test.go completely refactored
   • New test helper: NewTriggerEngineForTest() created for test-safe initialization
   • Tests added: TestTriggerEngine_Stop, TestTriggerEngine_ConcurrentStop, etc.
   • Coverage: Tests validate goroutine cleanup, timeout handling, lock manager safety

2. Goroutine Lifecycle Management (WatchSecret interface):

   • Code change: Added context.Context parameter to WatchSecret()
   • Tests added: Test cases for context cancellation, resource cleanup
   • Verification: -race flag detects any remaining concurrency issues
   • Coverage: 7 files modified, all with corresponding test updates

3. Resource Cleanup (defer patterns):

   • Code changes: defer close(ch), defer ticker.Stop(), tmpFile.Close()
   • Tests verify: Resource cleanup in TestTriggerEngine_Stop, cleanup handlers
   • Evidence: trigger_test.go shows cleanup validation

Examples from commit history:

• Commit: "Fix critical production blockers..."

  • Files changed: internal/agent/trigger_test.go (added/updated 15+ test functions)
  • Coverage impact: Maintained 85% critical package coverage

• Commit: "Add context support to WatchSecret..."

  • Files changed: pkg/api/plugin.go, cmd/plugins/*/main.go
  • Tests added: Provider-specific test cases for context handling

Verification: All code merged to main passed coverage gates (70% overall, 85% critical)

Yes, the project documents test requirements for change proposals.

Documentation locations:

1. CONTRIBUTING.md (Primary source):

   • Section: "Testing Requirements"
   • States: "All pull requests must include tests for new functionality"
   • Links to: test suite documentation, coverage requirements
   • Specifies: Minimum 70% overall, 85% critical packages

2. GOVERNANCE.md (Code Review Standards):

   • Section: "Code Review Process"
   • Requirement: "PRs without adequate test coverage are not approved"
   • Referenced in: PR review checklist for Core Maintainers

3. Pull Request Template (Optional but recommended to add):

   • Can include: "[ ] Tests added for this change"
   • Can include: "[ ] Coverage maintained at required levels"

4. Automated messaging in CI:

   • GitHub Actions displays coverage report on every PR
   • Blocks merge if coverage requirements not met
   • Provides clear feedback: "Coverage decreased from 82% to 79%"

Current state:

• CONTRIBUTING.md documents test expectations ✓
• GOVERNANCE.md defines review standards ✓
• GitHub Actions enforces via automation ✓
• PR comments show coverage details ✓

Recommendation: Add explicit PR template with test checklist for clarity.

Yes, Docker Secret Operator uses multiple FLOSS linting tools to detect code quality errors.

Linter tools used:

1. go vet (built-in, FLOSS) - Detects suspicious code patterns
2. go test -race (built-in, FLOSS) - Detects race conditions
3. staticcheck (FLOSS) - Advanced static analysis

Invocation:

• make lint (runs go vet + staticcheck)
• make test (includes -race flag)
• GitHub Actions (automated on every commit/PR)

Configuration: .github/workflows/coverage.yml

This catches:

• Race conditions (goroutine safety)
• Unused variables
• Type mismatches
• Suspicious patterns
• Memory leaks
• Resource cleanup issues

All tools are open source with no proprietary dependencies.

Yes, Docker Secret Operator addresses all linter warnings.

Process:

• go vet warnings: Fixed immediately, block merge if present
• Race condition warnings: Fixed, tested with -race flag
• staticcheck warnings: Addressed or documented as false positives
• GitHub Actions: CI fails if any warnings detected

Evidence from Phase 1 (May 2026):

• Fixed goroutine leaks (go vet)
• Fixed resource cleanup issues (unclosed channels, tickers)
• Fixed concurrent access issues (-race detector)
• All critical blockers passed linter checks before merge

Current status: Zero outstanding linter warnings in main branch

Yes, Docker Secret Operator enforces strict warning settings.

Strictness measures:

• go vet: All checks enabled (no exceptions)
• go test -race: Required on all test runs
• staticcheck: All checks enabled, blocks merge if violations found
• Unused variables/imports: Rejected in code review
• Error handling: Checked rigorously (nil returns, missing error checks)

Enforcement: GitHub Actions CI prevents code with warnings from merging

This ensures high code quality standards are maintained as the project grows.

Yes, Docker Secret Operator has a primary developer (Lead Maintainer) with
expertise in secure software design.
Primary Developer:

• Name: Md Umair
• Email: umairmd385@gmail.com
• Role: Lead Maintainer, Architecture Decision Maker

Evidence of secure design knowledge:

1. Security Documentation (SECURITY.md):

   • Threat model and attack surface analysis
   • Zero-trust principles implemented
   • Vulnerability disclosure process designed
   • Secure fallback behavior defined

2. Security Architecture Decisions:

   • Context-based goroutine lifecycle (prevents resource leaks)
   • Lock manager fail-fast design (prevents silent data corruption)
   • Socket permissions enforced (0660 with gid verification)
   • Race condition detection in all tests (-race flag)
   • Timeout controls on critical I/O (prevents indefinite hangs)

3. Critical Security Fixes (Phase 1):

   • Fixed goroutine leaks (DoS prevention)
   • Fixed resource cleanup issues (prevents file descriptor exhaustion)
   • Implemented proper context cancellation (prevents zombie processes)
   • Fixed lock manager initialization (prevents concurrent rotation corruption)

4. Code Review and Governance:

   • Defined code review standards in GOVERNANCE.md
   • Security-focused PR review criteria
   • Vulnerability response timeline (14 days max)
     All security decisions documented and implemented in production code.

Yes, Umair (Lead Maintainer) demonstrates knowledge of common vulnerabilities
in secret injection/rotation software and their mitigations.

Common vulnerability types addressed in DSO:

1. Information Disclosure (Secret Leaks)

   • Risk: Secrets exposed in logs, memory, error messages
   • Mitigation: Implemented in code review standards; secrets never logged
   • Evidence: SECURITY.md threat model, code review guidelines

2. Race Conditions (Concurrent Access)

   • Risk: Secrets corrupted by concurrent rotation/injection
   • Mitigation: Lock manager with fail-fast design, -race testing
   • Evidence: Phase 1 fix - lock manager initialization, concurrent test cases

3. Resource Exhaustion (Goroutine Leaks)

   • Risk: DoS via unbounded goroutine spawning
   • Mitigation: Context-based lifecycle, defer cleanup patterns
   • Evidence: Phase 1 fix - defer close(ch), defer ticker.Stop()

4. Privilege Escalation

   • Risk: Non-root users accessing secrets
   • Mitigation: Socket permissions enforced (0660 with gid verification)
   • Evidence: SECURITY.md socket security section, permission checks

5. Denial of Service (Hangs)

   • Risk: Indefinite hangs on I/O operations
   • Mitigation: 30-second context timeouts on critical operations
   • Evidence: Phase 1 fix - resolver timeout, proxy scan timeout

6. File Descriptor Leaks

   • Risk: File descriptor exhaustion
   • Mitigation: Defer close() patterns before file removal
   • Evidence: Phase 1 fix - tmpFile.Close() in up.go

7. Provider Failures

   • Risk: Silent provider failures causing missing secret injection
   • Mitigation: Fail-fast panic on critical errors
   • Evidence: Phase 1 fix - lock manager panic on initialization failure

All mitigations implemented and tested in production code.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

Yes, Docker Secret Operator applies staticcheck (FLOSS) for advanced static analysis before releases. Runs via GitHub Actions CI/CD, blocks merge if violations found.

Yes, Docker Secret Operator applies gosec (FLOSS, MIT license) for security-focused
static analysis before releases.

gosec detects common vulnerabilities:

• Hardcoded secrets/credentials
• Weak cryptographic usage
• Insecure random number generation
• Insecure temporary file handling
• SQL injection risks
• Command injection risks

Applied via GitHub Actions CI/CD (.github/workflows/coverage.yml)
Blocks merge if vulnerabilities found.

Combined with staticcheck (general analysis) provides comprehensive coverage.

Yes, Docker Secret Operator fixes all medium and higher severity vulnerabilities
discovered by static analysis in a timely manner.

Process:

1. Static analysis tool (staticcheck/gosec) finds issue
2. CI/CD blocks merge if medium+ severity detected
3. Developer confirms vulnerability (false positives rejected)
4. Lead Maintainer assigns priority
5. Fix implemented and tested
6. Pull request reviewed and merged
7. Released in next patch version

Timeline by severity:

• Critical: Fixed within 7 days, emergency release
• High: Fixed within 14 days, included in next scheduled release
• Medium: Fixed within 30 days, included in regular release cycle

Evidence from Phase 1 (May 2026):

• Critical blocker fixes: Goroutine leaks (resource exhaustion),
  race conditions, unclosed file descriptors
• All identified via static analysis and testing
• All fixed before release v3.5.17
• Zero outstanding medium+ vulnerabilities in main branch

Tracking:

• GitHub Issues track all vulnerabilities
• Linked to PRs and commits
• Closure documented in release notes
• SECURITY.md documents response timeline

Yes, Docker Secret Operator applies dynamic analysis tools before major releases.

Primary tool: go test -race (FLOSS)

• Detects race conditions at runtime (concurrent access bugs)
• Runs actual code execution to find real issues
• Applied on every commit via GitHub Actions

Dynamic analysis applied:

1. go test -race ./...

   • Detects goroutine races
   • Finds unsafe concurrent access
   • Evidence: Phase 1 fixed goroutine leaks detected via race detector

2. go test -cover

   • Measures code execution coverage
   • Ensures all code paths tested
   • Enforced minimum: 70% overall, 85% critical packages

3. GitHub Actions CI/CD

   • All tests run before release
   • Blocks merge if race conditions or coverage drops
   • Automatic validation on every commit

Before v3.5.17 release:

• Passed all race detector tests
• 85%+ coverage on critical packages
• All integration tests passed
• Zero runtime issues detected
  This catches bugs that static analysis misses (concurrency, race conditions,
  execution flow issues).