To report a security vulnerability, please do NOT open a public issue. Instead:

1. Go to Security Advisories
2. Click "New draft security advisory"
3. Provide a detailed description of the vulnerability

We will respond to security vulnerability reports within 48 hours and will work with you to understand and address the issue. You can expect:

• A confirmation of receipt within 48 hours
• Regular updates on the progress
• Credit in the security advisory (unless you prefer to remain anonymous)

1. Always use the latest version of NSM
2. Pin your Nix package versions in production environments
3. Review the Nix expressions before running them
4. Keep your Nix installation up to date