Only the latest release is supported. A fix reaches users in the next release.

Report it privately through GitHub private vulnerability reporting. Only the maintainer can see the report. Do not open a public issue, pull request or discussion about it.

Include:

• what an attacker can do and what they need for it;
• the steps that show the problem: for example, the tent commands you ran with their specs, or a request to a cluster's Nomad API;
• the command, package or node component (tent or tent-node) involved.

The maintainer replies in the advisory, agrees on a fix and a disclosure date with you, and credits you in the advisory unless you ask not to be named.