# Security Policy

## Project Status

This project is currently in **alpha**.
It is under active, rapid development and **security issues are expected** as the design and implementation evolve.

We strongly encourage responsible disclosure and collaboration while the project matures.

---

## Reporting a Vulnerability

**Do not report security issues publicly.**

* ❌ Do **not** open public GitHub issues for security vulnerabilities
* ❌ Do **not** disclose vulnerabilities in discussions, PRs, or social channels

Instead, report vulnerabilities **privately** via GitHub Security Advisories:

👉 https://github.com/always-further/nono/security/advisories/new

This ensures:

* Coordinated disclosure
* Time to assess and remediate
* Protection for users and contributors

---

## LLM-Generated Findings

If a vulnerability is identified by a Large Language Model (LLM):

* ❌ Do **not** report it blindly
* ✅ Ensure you **fully understand and can explain** the issue
* ✅ Validate the impact and reproducibility

Low-quality or speculative reports slow down response time and reduce overall security effectiveness.

---

## Expectations

Given the alpha status:

* Breaking changes may occur without notice
* Security guarantees are **not yet stable**
* Some classes of vulnerabilities may not yet be fully mitigated

Use in production environments is **not recommended** at this stage.

---

## Future Security Work

Prior to reaching **v1.0**, the project will undergo:

* A **comprehensive third-party security audit**
* Hardening of core components and interfaces
* Formalization of security guarantees and threat models

---

## Disclosure Policy

We aim to:

* Acknowledge reports promptly
* Investigate and validate findings
* Provide fixes or mitigations where possible
* Coordinate disclosure with reporters

### Safe Harbor

When conducting security research in good faith and in accordance with this policy, we consider your research to be authorized. We will not initiate legal action against you for research that adheres to these guidelines.

---

## Thank You

Responsible disclosure helps make this project safer for everyone.
