We take the security of our projects seriously. Thank you for helping keep the V2X ecosystem safe by responsibly disclosing vulnerabilities you find in our software.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them privately by emailing info@nfiniity.com with [SECURITY] at the start of the subject line.

Please include as much of the following as you can:

• A description of the issue and its potential impact
• The affected project and version (or commit hash)
• Steps to reproduce, including any proof-of-concept code
• Suggested mitigation or fix, if known
• Your name and affiliation (if you wish to be credited)

We will acknowledge receipt within 3 business days and aim to provide an initial assessment within 10 business days.

1. You report the vulnerability privately.
2. We confirm the issue and determine its scope and severity.
3. We develop and test a fix, and prepare a coordinated disclosure timeline (typically up to 90 days from report).
4. We publish the fix and a security advisory crediting the reporter (unless anonymity is requested).

This policy applies to all repositories under the nfiniity GitHub organization, and to Vanetza and Artery. Some projects may have additional, project-specific security policies — check the project's own SECURITY.md if present.