If you discover a security vulnerability, please report it via GitHub Security Advisories.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Docker images are signed using Cosign with keyless signing via GitHub Actions OIDC.

cosign verify graystorm/blink2mqtt:latest \
  --certificate-identity-regexp="https://github.com/weirdtangent/blink2mqtt/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

• Container images are scanned with Trivy on every build
• Scan results are uploaded to the GitHub Security tab
• SBOM (Software Bill of Materials) is generated for each image
• Build provenance is attested for supply chain security