Security

Draft for review by a lawyer. Not yet in force. Items in brackets are still to be filled in.

Last updated: [date]

Report a vulnerability

Email [Security email] with the steps to reproduce it. Please do not share it publicly until we have fixed it.

What to expect

We reply within [three] working days, keep you updated, and credit you if you wish.

In scope

The NAP application, its installer and update channel, and this website.

Good faith

We will not take action against research done in good faith that avoids harming users or their data.

How NAP is built

A locked-down interface process, workspace trust, secrets kept in the operating system's store, and a supply-chain check in CI. Read more on the safety and privacy page.