This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
Security model: SECURITY.md, which links to the project's threat model at THREAT_MODEL.md.
Apache NimBLE is a Bluetooth Low Energy (BLE) host + controller stack.
Before reporting a security issue, consult THREAT_MODEL.md: most BLE
traffic is unauthenticated by the Bluetooth specification (open
advertising, pre-encryption traffic, and "Just Works" pairing has no MITM
protection), and those spec-defined behaviours are not NimBLE defects. The
in-model surface is memory safety in the radio PDU parsers (LL / HCI /
L2CAP / ATT / SM) and the correctness of the Security Manager's pairing
cryptography. See the §11a known-non-findings list.