We prioritize security reports and appreciate the community's help in keeping NSClient++ safe.

1. GitHub (Preferred): Please use the GitHub Security Advisory tool. This allows for private collaboration and disclosure.
2. Email: You may also email the author directly at michael at medin dot name.

Note: Due to aggressive spam filtering, emails occasionally get lost. If you do not receive a reply within 48 hours, please assume the email was filtered and kindly re-send it or, preferably, open a ticket via the GitHub link above.

There is no fixed cadence for updates, but we generally target one release per month.

• Vulnerabilities: Addressed immediately in a hotfix release.
• Other security issues: Addressed in the next scheduled maintenance release.

We frequently publish pre-releases. While these contain new code, they are generally safe to use and are not considered "experimental" in terms of stability. However, due to the complexity of the environments NSClient++ operates in, we rely on these releases to validate new features across different system configurations.

We strive to review and update dependencies at least every 4 months, and we monitor for security issues on a daily basis. You can review the exact versions used in our build pipeline configuration here.

If you identify a vulnerability in one of our dependencies that impacts NSClient++, please report it to us.

Dependency Security References:

• OpenSSL
• Mongoose Web Server
• Boost C++ Libraries
• Python
• Google Protobuf
• Crypto++
• Lua Bugs & Vulnerabilities
• TinyXML (CVE Search)
• MiniZ