See nc-agent SECURITY.md for the endpoint trust model. For hub-side issues (account, billing, dashboard), use the in-product support channel.

Coordinated disclosure: report vulnerabilities privately — never as a public issue. Expect acknowledgement within 72 hours.