If you discover a security vulnerability in any nesso-labs repository, please report it privately:
Email: security@nessolabs.it
Please include:
- Description of the vulnerability and its potential impact.
- Steps to reproduce or a proof-of-concept.
- Affected repository and version/commit (if known).
Do not open a public GitHub issue for security vulnerabilities.
| Step | Target |
|---|---|
| Acknowledgement | 2 business days |
| Initial assessment | 5 business days |
| Fix or mitigation | Based on severity — critical issues are prioritised |
This policy covers all repositories under the nesso-labs GitHub organisation.
We follow coordinated disclosure. We will work with you on a timeline before any public announcement. Credit is given to reporters unless they prefer to remain anonymous.