doc: security

Signed-off-by: Simon de Vlieger <[email protected]>
osbuild · May 28, 2024 · 65d2531 · 65d2531
1 parent 197247b
commit 65d2531
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/doc/06-security.md b/doc/06-security.md
@@ -1 +1,3 @@
 # Security
+
+`otk` assumes that any omnifest it processes comes from a trusted source. You should **NOT** run `otk` on an untrusted omnifest. The outputs produced by `otk` inherit the same trust level meaning that a malicious omnifest will produce a malicious output that should **NOT** be propagated to other programs.