NDU is a hobby project with a single maintained line. Security fixes are applied to the latest tagged release on main. Older tags receive no backports.

Please report suspected vulnerabilities privately, not in a public issue. Two channels:

1. GitHub private advisory — preferred. Open an advisory directly on the repo. Only maintainers see it until publication.
2. Email — if GitHub advisories are unavailable to you, reach out via the maintainer's contact info on the GitHub profile.

Please include:

• a description of the issue and its impact,
• reproduction steps or a proof-of-concept,
• affected versions (commit SHA or tag),
• any suggested mitigation.

Expect an initial acknowledgment within 7 days. Fix timelines depend on severity and the maintainer's availability — this is a spare-time project.

In scope:

• Privilege escalation via NDU's code paths (auth bypass, session handling, admin-only endpoint exposure).
• Unauthenticated or unintended data exposure (device metadata, credentials, session tokens).
• Injection flaws (command, SQL, XSS in the admin UI).
• Credential storage issues (data/users.json, custom/config.json, providers/*/config.json).
• Path traversal in any endpoint that accepts filenames.

Out of scope:

• Issues that require root on the host NDU runs on (by design, the service user has access to its own configs and data).
• Issues in third-party dependencies with an already-disclosed CVE — please report those upstream.
• Denial-of-service via unauthenticated burst traffic to /api/* (not addressed today; expected behaviour on a LAN service without a rate-limit layer in front).
• Social-engineering or physical-access attacks.

NDU ships scripts/install.sh which sets file permissions (chmod 600 on config files containing secrets, chmod 700 on data/) and optionally creates a dedicated ndu service user. See docs/secure-deployment.md for the threat model and step-by-step hardening.