Skip to content

Security

Reporting a vulnerability

If you believe you've found a security vulnerability in this SDK, please do not open a public GitHub issue for it.

Instead, use GitHub's private vulnerability reporting on this repository. This opens a private draft advisory visible only to you and the maintainers, so the details aren't public until a fix is available.

Please include:

  • A description of the vulnerability and its potential impact.
  • Steps to reproduce it, including affected SDK version(s).
  • Any suggested mitigation, if you have one.

We will acknowledge your report and work with you to understand and resolve the issue before any public disclosure. Response is best-effort, consistent with this SDK's maintenance status below — there is no fixed SLA.

Safe harbor

We consider security research conducted in good faith, consistent with this policy, to be authorized. We will not pursue legal action against a reporter for research done this way, and we will work with you to understand and address what you found.

Supported versions

Security fixes are backported to the 1.x line described in Versioning and support for as long as it remains the current stable line. There is no separate long-term-support commitment beyond that. 1.x is the final ACP line and is maintained on a best-effort basis.

Out of scope

Vulnerabilities in the NovaOS platform itself, as opposed to this client SDK, are out of scope for this repository — please report those through your NovaOS support channel instead.