Security patches and fixes are provided for the two most recent active branches:
| Branch | Status |
|---|---|
master |
✅ Latest stable — actively maintained. |
Older versions will not receive security updates. Users are strongly encouraged to upgrade to the latest stable release.
If you discover a potential security vulnerability, do not open a public issue.
Instead, report it privately through GitHub Security Advisories — use the Security tab in the repository header to create a private advisory.
For more information about private vulnerability reporting, see GitHub's documentation.
| Step | Action | Timeline |
|---|---|---|
| 1 | Report acknowledged. | Within 48 hours. |
| 2 | Issue reviewed and validated by maintainers. | — |
| 3 | Patch prepared on a private branch. | — |
| 4 | Fix released publicly; CVE ID assigned if applicable. | — |
| 5 | Reporter credited (unless anonymity requested). | — |
When using Nalix packages in production:
- Always use the latest version of each
Nalix.*NuGet package. - Do not disable integrity checks or modify package binaries.
- Validate all inputs and enforce encryption when using networking or cryptographic APIs.
- Review the official documentation for recommended security configurations.
For questions about this policy or secure usage of Nalix libraries, open a private security advisory or start a GitHub Discussion.