Email security-reports@kentauros.ai to report a suspected vulnerability privately to the Nautilo maintainers. We will reply by email to investigate and coordinate a fix. Do not open a public GitHub issue or pull request with exploit details.

The reporting page also explains what to include.

Include the smallest useful reproduction, affected version or commit, impact, and redacted diagnostics. Do not include real credentials, access tokens, private conversation content, customer data, recovery material, signing keys, or complete configuration files.

For general security guidance and self-hosting hardening, see the security documentation and operator hardening guide.

For a bug that does not expose sensitive information or enable unauthorized access, file a bug report. Include your version, operating system, and steps to reproduce the problem. The security reporting mailbox is for suspected vulnerabilities only; please keep ordinary bug reports on GitHub.

Security fixes are made on the current development line and included in new release versions. The current public release status and supported artifacts are listed at nautilo.ai/product-release-status.

Do not assume an older Desktop, CLI, server, bootstrap, or deployment artifact receives fixes indefinitely. Upgrade to the latest supported release before reporting a defect that has already been corrected there.

After maintainers confirm that disclosure is safe, follow-up fixes and public discussion may use the normal contribution process in CONTRIBUTING.md. Until then, keep all exploit details and sensitive evidence in the private reporting channel.