Please report suspected vulnerabilities confidentially through this repository's Security → Advisories → Report a vulnerability form (GitHub Private Vulnerability Reporting). Include affected commit/version, reproduction steps, impact and a minimal proof of concept using synthetic data. Do not attach production credentials, database dumps, deployment keys or real vault contents.

Do not open a public issue containing exploit details or secrets. If the private reporting button is unavailable, the repository's reporting configuration is incomplete: do not post sensitive details publicly. Maintainers must enable private reporting before public launch, following GitHub's configuration guide.

Reports concern nodePass. The upstream sysPass project's contact address is not nodePass's security contact. No guaranteed response time or paid support commitment is implied.

The current project version is 0.1.7. Report against the exact commit when possible. No long-term support branches or fixed support periods are promised. Production deployment requires the exact commit's Required release checks and operator-specific validation; local reports alone are insufficient.

Read the security model for trust boundaries and known constraints, and Operations for release requirements. Automated scans do not constitute an independent security audit.