We actively support the following versions with security updates:

We take the security of NoID Privacy seriously. If you discover a security vulnerability, please follow these steps:

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues via:

1. Email: security@noid-privacy.com
2. Subject Line: "SECURITY: [Brief Description]"
3. Include:
   • Detailed description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if available)
   • Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline:
  • Critical: 7-14 days
  • High: 14-30 days
  • Medium: 30-60 days
  • Low: 60-90 days

We appreciate security researchers who follow responsible disclosure:

• Your name (if desired) will be credited in the security advisory
• You'll be listed in our SECURITY_HALL_OF_FAME.md
• We'll link to your website/GitHub profile (with permission)

In Scope:

• Privilege escalation vulnerabilities
• Code execution vulnerabilities
• Authentication/authorization bypasses
• Information disclosure (sensitive data)
• Cryptographic weaknesses
• Denial of service (if exploitable)

Out of Scope:

• Social engineering attacks
• Physical attacks
• Issues requiring physical access to victim's device
• Issues already documented as known limitations
• Third-party dependencies (report to upstream)

When using NoID Privacy:

1. Always Backup: Create system backup before applying
2. Test First: Run in VM before production
3. Review Code: Understand what the script does
4. Verify Integrity: Check file hashes before running
5. Keep Updated: Use latest version for security fixes
6. Admin Rights: Only run with Administrator privileges when necessary
7. Trusted Sources: Only download from official repository

This project implements multiple security layers:

• Microsoft Security Baseline 25H2
• CIS Benchmarks
• DoD STIG
• BSI IT-Grundschutz

We welcome security audits from the community. If you'd like to perform a security audit:

1. Contact us beforehand
2. Focus on code review and functionality testing
3. Share findings privately first
4. Allow reasonable time for fixes before public disclosure

Current Limitations:

1. Standalone Focus: Not designed for domain environments
2. Third-Party AV: May conflict with some antivirus products
3. Hardware Requirements: Some features require TPM 2.0
4. Reversibility: Some changes (Recall, Copilot) are permanent
5. Manual Steps: Certain features require post-script configuration

Documented Issues:

• See KNOWN_ISSUES.md for current limitations
• See CHANGELOG.md for fixed vulnerabilities

When a security issue is confirmed:

1. Acknowledgment: Issue reporter receives confirmation
2. Investigation: Team investigates and validates
3. Fix Development: Patch is developed and tested
4. Security Advisory: CVE is requested (if applicable)
5. Release: Patch is released with security notes
6. Notification: Users are notified via GitHub Security Advisory
7. Public Disclosure: After fix is available (coordinated disclosure)

For security concerns:

• Email: security@noid-privacy.com
• PGP Key: [Available on request]

For general issues:

• GitHub Issues: Report here
• General Support: support@noid-privacy.com

Last Updated: October 27, 2025
Version: 1.0

We thank the following security researchers for responsible disclosure:

No security vulnerabilities have been publicly disclosed at this time.

Thank you for helping keep NoID Privacy secure! 🙏