Please don't open a public issue for a security problem. Report it privately in either of these ways:

• Private vulnerability report: open the repository's Security tab and choose Report a vulnerability.
• Email: security@nomba.com.

Include the repository, the affected version, a description and the steps to reproduce. We aim to acknowledge reports within three working days and will keep you updated until a fix is released.

These projects move money, so we treat anything that could cause a duplicate payment, a forged webhook being trusted, or leaked credentials as a vulnerability.

Only the latest minor release of each project receives security fixes. Fixes ship as a new patch version.

This policy covers the code in the NombaOSS repositories. To report a problem with the Nomba platform or API itself, email security@nomba.com.