We take the security of NovaStack and the projects generated by it very seriously. This document outlines how to report vulnerabilities and what versions are actively supported.

Only the latest release of NovaStack is actively supported with security updates and patches.

We recommend that all users run the latest version of the CLI (npm install -g novastack@latest or npx novastack@latest) and keep the dependencies of generated projects up-to-date.

If you discover a security vulnerability in NovaStack, please do not open a public issue. Doing so risks exposing users to potential exploitation before a fix is ready.

Instead, please report vulnerabilities by emailing our core security team at security@novastack.dev.

In your report, please include:

• A detailed description of the vulnerability.
• The version of NovaStack CLI and generated packages where the issue occurs.
• Steps to reproduce the vulnerability (or a proof-of-concept script/project).
• Any details about potential impact or how it could be exploited.

Once we receive your report:

1. Acknowledgment: We will acknowledge receipt of your email within 48 hours.
2. Assessment: We will investigate the issue and assess its severity.
3. Patching: If a vulnerability is confirmed, we will work on a patch.
4. Disclosure: We will coordinate a disclosure timeline with you and release the patch, acknowledging your contribution in our security releases (unless you request anonymity).