# Cozystack security report — August 2026

Generated 2026-08-11 from the tracker state on that date. **This month is incomplete: data is cut off at 2026-08-10.** Figures are counted from the tracked findings of the organization-wide CVE-scanning pipeline described in [`SECURITY.md`](../../../SECURITY.md).

**Read this alongside [the backlog reconciliation](reconciliation-2026-08.md).** The state counts below are what the pipeline recorded, and the pipeline has no write-back from the main repository, so it has never marked anything fixed and its outstanding counts overstate real exposure. The reconciliation establishes what was actually remediated and how much of the backlog was never applicable. Do not read the tables here as a measure of exposure without it.

**Disclosure.** Findings are reported as counts by severity; an individual finding is named once its fix is merged and released. Counts cover findings the pipeline tracks as actionable, after its filters for development-and-build-only dependencies, findings whose upstream has had no fix for over a year, and findings with no severity assigned in any database. Two of those filters are known not to work as documented — see the reconciliation.

## New findings tracked this month

**17** — 17 high

## Triage decisions recorded this month

No triage decisions were recorded this month.

## Remediation activity this month

**2** version bumps were merged, representing **1** distinct changes once backports of the same change to release branches are collapsed. These are counted from diffs: a pull request that only moves a chart version, edits an upgrade path or changes CI configuration is not counted as a bump, because it cannot carry a fix into an artifact.

How many tracked findings those bumps carried away is deliberately **not** stated per month. Attributing findings to one month's bumps would cross a severity-banded count of still-open findings with a component list that is publicly enumerable from the commit log, which narrows the search for unpatched exposure more than a bare count does. The remediation disposition of the whole backlog is given once, with an as-of date, in [the reconciliation](reconciliation-2026-08.md).

## Position at 2026-08-10

| State | Count | By severity |
| --- | --- | --- |
| Awaiting a triage decision | 331 | 13 critical, 318 high |
| Confirmed — real, needs a fix | 332 | 30 critical, 292 high, 10 medium |
| Accepted risk — real, not reachable or not worth the change | 61 | 6 critical, 52 high, 3 medium |
| Dismissed — not applicable | 101 | 5 critical, 93 high, 3 medium |
| **Total tracked** | **825** | |

Nothing appears as fixed in any month because the pipeline cannot record that state at all. Confirmed findings therefore accumulate and never drain, which is a property of the tooling rather than a measure of outstanding work.

## Where the process stands

**Triage is behind its target and has no owner.** The rotating Security Champion role that owns the triage clock is defined in the pipeline's governance document and is currently unassigned. That is why decisions arrived in a single bulk pass rather than continuously, and it is the project's real gap — not the bookkeeping problem below.

**The configured detection schedule** is every six hours for critical findings and weekly for the rest. Whether every scheduled run executed cannot be established from finding data alone, and the record has gaps: no weekly cohort appears for 2026-05-26, and intervals between critical findings reach 26 days. Absence of findings is not proof of a missed run, but neither is it proof of a completed one.

**Remediation is happening and the tracker cannot see it.** Fixes land in the main repository as ordinary pinned-component bumps and nothing writes that back here. [The reconciliation](reconciliation-2026-08.md) sets out what was actually fixed, which components still need a bump that is already available upstream, and the defects found in the pipeline itself.

## Reporting a vulnerability

Please do not use public issues. Use [GitHub Private Vulnerability Reporting](https://github.com/cozystack/cozystack/security/advisories/new) or contact a maintainer privately; the full policy is in [`SECURITY.md`](../../../SECURITY.md).