Security fixes target the latest stable release of the Namera packages and the current main branch for application deployments. Older releases are not maintained as separate security branches; upgrade to the latest stable release.

Email hey@namera.ai with the subject Namera security report. Do not open a public issue or pull request containing vulnerability details.

Include:

• The affected package, version or commit, and deployment type.
• A description of the issue and its potential impact.
• Minimal reproduction steps or a proof of concept using test accounts.
• Any relevant logs with credentials and personal information removed.

Never send private keys, seed phrases, session-key exports, passwords, access tokens, or another user's data. Use local or isolated test environments; do not access other users' accounts, move real funds, or disrupt production services.

We will investigate reports and coordinate remediation and disclosure with the reporter. Please keep details private until a fix and disclosure timeline have been agreed. No response-time or bounty commitment is implied by this policy.