We now have a mailing list set up for receiving embargoed notices of security vulnerabilities in Kata Containers. This list is intended for the appropriate security contact at downstream stakeholders (distros incorporating Kata, public clouds offering Kata to customers, etc) so they can coordinate releasing fixes before they are publicly disclosed. 

This list is for confidential announcements from the Kata vulnerability management team only; to report a vulnerability, please visit https://launchpad.net/katacontainers.io

If you are a downstream consumer, you can send your security contact to subscribe here: http://lists.katacontainers.io/cgi-bin/mailman/listinfo/embargo-notice

Please let me know if you have any questions.

Cheers,