Do not report vulnerabilities through public issues.

• GitHub Security Advisories (private report)

• Email: security@navig.run
• Subject: [SECURITY] <short title>

1. Acknowledgement: within 24 hours.
2. Triage + severity classification: within 72 hours.
3. Remediation plan: within 7 calendar days.
4. Patch target windows:
   • Critical: 1-7 days
   • High: 7-14 days
   • Medium: 30 days
   • Low: 60+ days or bundled release
5. Coordinated disclosure: default 90 days max, earlier when patch ships.

If active exploitation is confirmed, emergency release and disclosure are accelerated.

In scope:

• CLI command and subprocess security boundaries
• SSH, credential, vault, and secret handling
• MCP and gateway authentication/authorization flows
• Configuration parsing and privilege-sensitive operations

Out of scope:

• Social engineering
• Physical host compromise
• Vulnerabilities in third-party services with no NAVIG defect

For a confirmed issue:

1. Reproduce and document impact.
2. Patch with tests.
3. Run security + regression checks.
4. Publish fixed version + advisory.
5. Notify users and update changelog.

• requirements.lock is the canonical committed Python lockfile for this repo. Auxiliary lockfiles that duplicate the same dependency graph should not be kept in sync in parallel.
• If an upstream package has no published fixed release yet, keep the dependency surface minimal, document the constraint, and remove duplicate lockfile noise until a real patched version is available.
• Archived or reference-only subtrees should be excluded from active dependency graphs whenever possible so security tooling reflects shipped surfaces.

• Primary: security@navig.run
• Advisory portal: GitHub Security Advisories

Last updated: 2026-07-18