SECURITY & COMPLIANCE
Security Policy
Security Policy
Section titled “Security Policy”Security researchers and users who identify a suspected vulnerability affecting the Nest Protocol, its applications, APIs, or related Plume Network repositories should report it privately and responsibly.
Report a Vulnerability
Section titled “Report a Vulnerability”Do not open a public GitHub issue or publicly disclose a suspected vulnerability before the security team has had an opportunity to investigate and remediate it.
Email security@plume.org and include:
- A clear description of the vulnerability.
- The affected component, contract, API, repository, chain, or version, if known.
- Steps to reproduce the issue.
- The potential impact.
- A suggested fix, if available.
What to Expect
Section titled “What to Expect”The security team will acknowledge receipt within 48 hours and aims to provide a detailed response within seven days. The team may request additional information while validating the report and determining the appropriate remediation.
Supported Versions
Section titled “Supported Versions”Security patches are provided for the latest major versions of actively maintained projects.
Security Updates
Section titled “Security Updates”After a vulnerability is confirmed, security updates are released as soon as possible. Notices may be published through:
- GitHub Security Advisories.
- Release notes.
- Direct communication for critical issues.
Secure Contributions
Section titled “Secure Contributions”Contributors should:
- Never commit secrets, API keys, private keys, or credentials.
- Use environment variables for sensitive configuration.
- Follow secure coding practices.
- Report security concerns promptly through the private channel above.
The canonical reporting policy is maintained in the Nest Protocol repository.