Pre‑alpha: No official support timeline yet; vulnerabilities will be addressed case by case.

Email: security@dip-dev.example (replace with real address before first tagged release).

Please include:

• Affected component / file (if known)
• Reproduction steps or proof-of-concept
• Potential impact assessment
• Suggested remediation (optional)

Do NOT open a public issue for sensitive vulnerabilities.

You will receive an acknowledgement within 5 business days (after real address activation). We aim to triage within 14 days.

1. Private report received & acknowledged.
2. Triage & severity assessment.
3. Fix developed and reviewed.
4. Coordinated release with attribution (unless anonymity requested).

At this stage Nestra is not a hosted service. Issues related to local environment compromise, user misconfiguration, or third‑party site behaviors are generally out of scope unless Nestra significantly amplifies risk.