Until OpenNV reaches 1.0, security fixes are provided for the latest released 0.x version only. After 1.0, this table will list supported major lines.

Do not open a public issue. Use GitHub's Report a vulnerability action on the repository Security tab to create a private security advisory. Include the affected schema or endpoint, impact, reproduction payload, known deployments, and any suggested mitigation. Do not include live credentials or production device data.

Maintainers will acknowledge a complete report within five business days, triage severity, coordinate affected OpenNV repositories, and provide status at least every ten business days until remediation or closure. Disclosure timing is coordinated with the reporter after affected releases are available.

Schema validity does not establish authorization or safety. Implementations must separately enforce authentication, tenant boundaries, admission budgets, secret-reference resolution, payload limits, execution timeouts, and sandbox limits. Treat YAML/JSON documents, Git repositories, device output, and Starlark programs as untrusted input.