If you discover a security vulnerability in nodesafe (not in nodes it scans), please report it privately:

• Preferred: open a GitHub Security Advisory
• Or email: security@nodesafe.dev (PGP key: see KEYS.txt in repo root once published)

Do NOT open public issues for vulnerabilities. We follow coordinated disclosure:

1. We acknowledge receipt within 72 hours.
2. Initial assessment and severity rating within 7 days.
3. Fix prepared and tested. Embargo period negotiated with reporter (typically 30-90 days).
4. CVE issued if applicable. Reporter credited in advisory unless they prefer anonymity.
5. Public disclosure after fix release.

If you found a malicious custom_node that nodesafe missed:

1. Open a public issue with tag [missed-detection] and details:
   • Repo URL of the malicious node
   • What it did (or attempts to do)
   • What nodesafe reported (verdict, score, findings)
   • Why it should have been flagged
2. Or open a PR adding the hash to signatures/known_malware.jsonl with a reference to the public disclosure of the incident.

We publish a postmortem within 14 days for significant misses, explaining:

• Why the miss happened (which layers failed to detect)
• What we changed (new signatures, rule updates, dataset additions)
• How users can verify their existing installations weren't affected

If nodesafe flagged a legitimate node as malicious:

1. Open an issue with tag [false-positive]
2. Include: the node, the findings reported, and why they're benign
3. We'll triage within 7 days and adjust rules/thresholds if confirmed

False positives are taken as seriously as misses — a scanner that cries wolf loses trust.

The full STRIDE-based threat model lives in docs/threat-model.md. It covers:

• What nodesafe defends against (code execution via plugins, data exfiltration, typosquatting, known malware patterns).
• What nodesafe does not defend against (supply chain compromise upstream, runtime behavior monitoring, network-level attacks, sandbox escapes).
• Adversarial scenarios we considered.

We support the latest minor version. Security fixes are backported to the previous minor for 90 days after a new minor is released.

Once V1.0 ships, support policy will be updated.

• Signature DB updates are served over HTTPS only.
• Once we stabilize the format (V1+), signature releases will be signed with a GPG key published in the repo. nodesafe update --verify will check the signature before applying.
• API keys for cloud LLM providers are BYO — nodesafe never has its own keys and never transmits user-provided keys anywhere except to the chosen provider.

• Zero telemetry by default. This is non-negotiable.
• No phoning home for any reason except explicit nodesafe update invocation (HTTPS to public endpoint, no identifying headers).
• Layer 8 LLM analysis is opt-in. When enabled with cloud provider, only the code of the node being scanned is transmitted — never environment data, never telemetry.

For questions about this policy: open a discussion tagged security-policy.