Security Policy

Supported Versions#

NimbusKV is currently pre-1.0 and moves quickly. Security fixes are only guaranteed for the latest released minor version.

Once the project reaches a stable 1.0, this table will be expanded to cover a longer support window (e.g. current + previous minor).

Reporting a Vulnerability#

Please do not open a public GitHub issue for security vulnerabilities. Discussing a vulnerability in the open before a fix is available puts every user of the library at risk.

Instead, report it privately using one of these two channels:

1. Preferred: use GitHub's private vulnerability reporting — go to the Security tab of this repository and click "Report a vulnerability." This opens a private advisory visible only to the maintainer until a fix is ready.
2. Alternative: reach out to project maintainers privately via GitHub Security Advisories with a description of the issue, steps to reproduce, and the affected version(s).

What to include#

To help triage quickly, please include:

• The version of nimbuskv affected (and backend in use, if relevant — memory / SQLite / Redis)
• A minimal reproduction, if you have one
• The potential impact as you understand it (e.g. data corruption under concurrent access, unsafe deserialization, denial of service)

What to expect#

• Acknowledgment: within 5 business days.
• Status updates: at least every 2 weeks while the issue is worked on.
• Disclosure: once a fix is released, the reporter will be credited (unless anonymity is requested) in the release notes and CHANGELOG.md, coordinated with the reporter on timing.

Scope note specific to this project#

NimbusKV's persistence layer uses pickle for the local SQLite backend by design (trusted local file). If you're evaluating a deployment where the backend or its contents could be untrusted/network-reachable, that's a real risk worth reporting even if it's "expected behavior" today — where wire-format serialization without pickle is evaluated for this reason.

Thank you for helping keep NimbusKV and its users safe.