Security fixes are provided for the latest release. When a new version is published, older versions no longer receive security patches. Until the first tagged release, the supported code is the main branch.

Thank you for taking care to report a problem privately. If you believe you have found a vulnerability:

1. Email the report to security@nubank.com.br. For a sensitive report, encrypt the message with the PGP key published at https://nubank.com.br/.well-known/security.txt. You may also open a private GitHub security advisory.
2. Do not use the vulnerability, and do not discuss it in a public issue, pull request, or any other public channel until a fix is released.
3. Include the version or commit you tested, a short description of the impact, and the steps needed to reproduce the problem.
4. We will acknowledge the report, keep you informed of progress, and credit you in the published advisory if you want to be named. Please write reports in English. A public GitHub issue is the right place for a usage question or a bug that does not affect security. It is the wrong place for a vulnerability.

We will confirm receipt of a report sent to the address above. Fixes ship in the latest supported version, and a GitHub security advisory is published when the issue is resolved and users need to upgrade.