NOID documents describe intended boundaries; they do not enforce them.

Do not place secrets, credentials, personal data, internal addresses, customer information or production configuration in a NOID document or public issue.

Do not publish a security concern containing sensitive information in a public issue.

For the public repository, use GitHub's Report a vulnerability route at https://github.com/virtuallynoidea/noid/security/advisories/new. This route must be enabled and verified as part of public activation.

Until that route is active, email enquiries@virtuallynoidea.com with the subject NOID security report. Include only the minimum information needed to start a private conversation; do not send credentials, customer data or live exploit material unless a secure exchange has been agreed.

NOID is currently a specification, structural checker and synthetic demo—not a production runtime. A report may still cover unsafe example behaviour, validator defects, misleading security claims, repository disclosure or a boundary failure.