Please do not report security vulnerabilities through public GitHub issues.
Report privately via GitHub's Security Advisories ("Report a vulnerability"). Include a description, affected package(s) and version(s), reproduction steps, and impact. You will receive an acknowledgement, and we will coordinate a fix and disclosure timeline with you.
Because this is a security-relevant identity library, please give us a reasonable window to release a fix before any public disclosure.
Until the first stable (1.0.0) release the project is pre-release (-alpha); only the latest published version is
supported. Once GA, security fixes target the newest patch of each supported major.minor line; see
GOVERNANCE.md for the release-line model.
Packages are built deterministically and source-linked to this public repository (ADR-0007); released packages should be signed and RFC-3161 timestamped. Verify a downloaded package with:
dotnet nuget verify path/to/NCode.Identity.<version>.nupkgThe correct-by-default posture is a security feature: there is no public API to disable issuer / audience / signature / lifetime / algorithm validation, or to weaken a security control below its safe baseline. A report that such a control can be bypassed through the public surface is in scope.