Novac Stack takes the security of its software and its clients' data seriously. We appreciate responsible disclosure from the security community.

Please do not report security vulnerabilities through public GitHub issues.

Use GitHub's private vulnerability reporting: open the Security tab of the affected repository and choose Report a vulnerability. If the repository does not have it enabled, contact us through novacstack.com and mention "security" in the subject.

Please include:

• the repository and version or commit affected
• a description of the issue and its potential impact
• steps to reproduce or a proof of concept
• any suggested mitigation

• Acknowledgement of your report within 3 business days.
• An initial assessment and severity classification within 10 business days.
• Regular updates while a fix is prepared, and credit in the release notes if you wish.

We ask that you give us reasonable time to address the issue before any public disclosure, and that you avoid accessing or modifying data that is not your own.

Security fixes are applied to the latest release of each actively maintained repository. Repositories marked as archived do not receive fixes.