This policy covers security issues in the Nirun codebase maintained in this repository.
Out of scope:
- vulnerabilities in upstream Odoo base that are not introduced or worsened by Nirun modules
- vulnerabilities in third-party dependencies that are unrelated to Nirun-specific code
- general support questions or configuration help requests
If an issue affects both Nirun and an upstream project, report it here as well and note the upstream component involved.
Report suspected vulnerabilities by email to nirun@nstda.or.th.
Please do not open a public GitHub issue for a security report.
Include as much of the following as possible:
- affected module, branch, and version or commit
- deployment context and prerequisites
- reproduction steps or proof of concept
- impact assessment
- any suggested mitigation or fix
We will review reports, assess whether they are in scope, and coordinate next steps from the contact address above.
When possible, share enough detail for us to reproduce the issue before public disclosure.
Please use responsible disclosure and allow time for assessment and remediation before publishing details.