Please do not report exploitable vulnerabilities through public issues, pull requests, or discussions.

Report privately to the maintainers of the affected Nexss repository with:

• A minimal reproduction (or a clear description of the exploit path)
• The affected version, tag, or commit
• The impact you believe it has
• Any proposed mitigation, if you have one

We aim to acknowledge reports within a few business days.

Only the latest release on the default branch receives security fixes. Older tags are not patched; upgrade to the current release.

We coordinate disclosure with the reporter. Once a fix is released, we publish a short advisory describing the affected package, the fixed version, and the impact — never the reporter's identity unless they ask to be credited.