NERVA treats secure defaults and responsible disclosure as engineering requirements. The project is nevertheless pre-1.0 and has no stable, production-supported release yet.

Support information will be updated before a stable release. A pre-1.0 tag does not imply a long-term patch commitment.

Do not open a public issue, discussion, or pull request for a suspected vulnerability.

Use GitHub's private vulnerability reporting for the NERVA repository when it is available. If that channel is unavailable, contact a maintainer privately through an address published on the repository owner's verified GitHub profile and state that the message is a security report. Do not send exploit details through a public channel.

Include, where possible:

• the affected commit or version;
• the affected package, API, or configuration;
• prerequisites and a minimal reproduction;
• expected and observed behavior;
• security impact and realistic attack scenario;
• whether the issue is already public or actively exploited; and
• a safe way to contact you.

Please remove credentials, tokens, personal data, and unrelated production information from reproductions.

A maintainer will acknowledge reports as project capacity permits, validate the issue, and coordinate remediation and disclosure with the reporter. The pre-1.0 project does not promise a fixed response SLA. We will aim to keep reporters informed, credit them if requested, and publish enough information for users to assess impact after a fix is available.

Please allow a reasonable remediation window before disclosure. If maintainers cannot reproduce the report or consider it out of scope, they will explain why when a safe contact channel is available.

Relevant reports include, but are not limited to:

• request smuggling, routing confusion, path or header parsing flaws;
• cross-request state leakage or unsafe object reuse;
• authentication or authorization bypass in released security modules;
• secret exposure through errors, logs, diagnostics, or benchmark data;
• denial of service through unbounded memory, goroutines, input, or work;
• unsafe network defaults, credential handling, or host verification in released network modules; and
• dependency vulnerabilities with a reachable NERVA impact.

Reports about roadmap features that do not exist yet, generic scanner output without a reachable impact, social engineering, and attacks requiring prior control of the host are normally out of scope.

Use test systems and the minimum access needed to demonstrate impact. Do not access other people's data, disrupt services, retain secrets, or use destructive payloads. Good-faith research following this policy will not be intentionally pursued by the project, but this policy cannot authorize activity on infrastructure owned by third parties.

Confirmed fixes and any necessary upgrade guidance will be recorded in release notes or CHANGELOG.md. Security-sensitive tests may remain private until a coordinated release if publishing them would expose users before a fix is available.