We take security seriously at Nubster. If you discover a security vulnerability in Egide, please report it responsibly.

DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please email us at: security@nubster.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution Timeline: Depends on severity (critical: ASAP, high: 30 days, medium: 90 days)

The following are in scope:

• egide-server binary
• egide-cli tool
• All egide-* crates
• Official Docker images
• Official documentation (if it leads to security issues)

Out of scope:

• Third-party integrations
• Social engineering attacks
• Physical security

When deploying Egide:

1. Never run in dev mode in production (release builds, including the published Docker image, refuse dev mode by design)
2. Use TLS for all connections
3. Rotate unseal keys regularly
4. Enable audit logging
5. Use least privilege for policies
6. Keep Egide updated
7. Backup sealed data regularly

Security advisories will be published through GitHub Security Advisories on the Egide repository.

We do not currently have a formal bug bounty program. However, we recognize and thank security researchers who responsibly disclose vulnerabilities.