Security Policy
How to report a suspected security vulnerability and what to expect after reporting it.
Security Policy
Security researchers and users who identify a suspected vulnerability affecting the Nest Protocol, its applications, APIs, or related Plume Network repositories should report it privately and responsibly.
Report a Vulnerability
Do not open a public GitHub issue or publicly disclose a suspected vulnerability before the security team has had an opportunity to investigate and remediate it.
Email security@plume.org and include:
- A clear description of the vulnerability.
- The affected component, contract, API, repository, chain, or version, if known.
- Steps to reproduce the issue.
- The potential impact.
- A suggested fix, if available.
What to Expect
The security team will acknowledge receipt within 48 hours and aims to provide a detailed response within seven days. The team may request additional information while validating the report and determining the appropriate remediation.
Supported Versions
Security patches are provided for the latest major versions of actively maintained projects.
Security Updates
After a vulnerability is confirmed, security updates are released as soon as possible. Notices may be published through:
- GitHub Security Advisories.
- Release notes.
- Direct communication for critical issues.
Secure Contributions
Contributors should:
- Never commit secrets, API keys, private keys, or credentials.
- Use environment variables for sensitive configuration.
- Follow secure coding practices.
- Report security concerns promptly through the private channel above.
The canonical reporting policy is maintained in the Nest Protocol repository.