Report a vulnerability
Please do NOT publicly disclose security vulnerabilities in public GitHub issues. Instead, report them privately by emailing us directly:
When reporting, please include as much detail as possible to help us reproduce and resolve the issue:
- Description and potential impact of the vulnerability
- Clear steps to reproduce (or a proof-of-concept script/exploit)
- Affected page, API endpoint, or package/component
- Relevant screenshots, videos, or logs where appropriate
Responsible disclosure
Please allow reasonable time for the issue to be investigated, verified, and addressed before disclosing it publicly or publishing details.
What to expect
Once a report is submitted, we will review the details, investigate the issue locally, and coordinate with you to address the vulnerability before deploying remediation updates.
Security practices
Mimir Nest leverages the following baseline open-source security practices built directly into our codebase:
Dependency Updates
We track and update external packages weekly using Dependabot automation.
Static Security Scans
CodeQL static analysis automatically runs on repository updates to scan for common vulnerabilities.
Encrypted Connections
All traffic to Mimir Nest is served over secure, encrypted HTTPS via Vercel.
Safe Secret Handling
Sensitive credentials and deployment tokens are stored securely in GitHub Secrets, avoiding repository exposure.