Please do not open a public GitHub issue for security vulnerabilities.

Use GitHub's private vulnerability reporting to report issues confidentially.

We will acknowledge reports within 5 business days and aim to release a fix within 30 days for confirmed vulnerabilities.

The severity-tiered targets below refine the general promise above. NovaFabric is a pre-1.0 open-source project maintained by a small team: these are best-effort commitments, not a contractual SLA. They cover both privately reported vulnerabilities (disclosure flow above — unchanged) and dependency CVEs surfaced by our automated scanners.

Severity follows CVSS as assigned by the advisory source; triage may adjust it for NovaFabric's actual exposure (e.g. a vulnerable code path we never call).

"Fix or mitigate" includes a documented workaround or a default-off toggle when a complete fix needs longer than the window.

• CI runs pip-audit against the locked Python dependency set on every pull request and weekly; HIGH/CRITICAL findings block merges.
• CI runs npm audit against every tracked npm lockfile (ui/dashboard/, packages/nova-dashboard/, packages/nova-sdk-ts/) on lockfile changes and weekly, behind the same severity gate; HIGH/CRITICAL advisories block.
• Release container images are scanned with trivy; CRITICAL findings with an available fix block the release.
• Exceptions go through the checked-in waiver files .pip-audit-waivers.toml and .npm-audit-waivers.toml — one schema, parsed by the same code: every waiver carries the vulnerability id, a written justification, and an expiry date. An expired waiver fails CI by construction, so accepted risk is always time-boxed and re-reviewed — waivers cannot rot into permanence.

NovaFabric is pre-1.0 and releases frequently (multiple tagged releases per week during active development). Given that cadence, only the latest tagged release is supported — there is no maintained LTS line before v1.0. See the releases page for the current version.

The full policy — what upgrading promises today, the runtime support matrix, and the channel/LTS structure that takes effect at the v1.0 freeze — lives in docs/support-policy.md.

NovaFabric is local-first: in its default configuration it is a self-contained CLI tool with no network surface. The always-present attack surfaces are:

• YAML parsing (malicious spec files)
• SQLite database access (local filesystem)
• CLI argument handling

Several opt-in surfaces exist and are disabled by default; each has a STRIDE analysis in the project's internal threat model:

• Server mode (nova server / nova serve) — network-exposed REST API (OIDC/RBAC or token auth).

• Outbound lifecycle webhooks (NOVA_EVENTS_WEBHOOK) — the only outbound network path; no default destination, payloads are IDs/digests only and secret-scanned before emission, HMAC signing is optional and recommended.

• SCIM 2.0 provisioning (/scim/v2) — inbound, active only when both the config flag and the dedicated NOVAFABRIC_SCIM_TOKEN are set; otherwise 404.

• SAML endpoints (/v0/auth/saml/*) — SP metadata is always available read-only. Assertion consumption (login + ACS) is refused (501) unless the operator explicitly sets server.saml.experimental_acs_enabled: true (the ADR-0138 D5 license gate cleared in v0.73.0 via the Tier-A signxml library); signature validation is never skipped, even when enabled. This path remains experimental, and Security-Architect review is a recorded pre-production blocking condition regardless of the opt-in flag.

• OTLP GenAI ingest (POST /api/otlp/v1/traces) — token-authenticated; foreign span data is secret-scanned at write time, the manifest is redacted, and the finished capsule gets the same residual pass, evidence_digests and opt-in seal as nova capture (since v0.105.0). Ingested capsules stay labeled capture_level: ingested-otlp.

• Remote runners (nova capture --runner {docker,kubernetes,slurm,lsf,pbs}) — send the workload to a container, cluster or batch scheduler. They forward a default-deny allowlist of environment variables (NOVAFABRIC_*, plus PATH for slurm and any explicit extra_env), never the submitting shell's environment (ADR-0270). --runner local is the deliberate exception: it runs as you, on your machine, inside the existing trust boundary.

  Fixed in this line: B2 (disclosed 2026-08-28, fixed 2026-09-10) — the Kubernetes runner wrote every submitting environment variable into the Job object as a literal value:, readable with get job and persisted in etcd. If you ran nova capture --runner kubernetes on an affected version, treat any credential that was in that shell as exposed to anyone with read access to the namespace, and rotate it.

If you find a way to make any disabled-by-default surface reachable without explicit opt-in, that is a vulnerability — please report it.

Capsule secret scanning is pattern-based. Every file in a Run Capsule is scanned and matches are redacted before the capsule is digested and sealed, and redaction-proof.json records what was scanned and redacted. It does not prove that a capsule holds no secret: formats with no rule (PEM private keys, JWTs, passwords, connection-string credentials, Slack/Stripe/Google/Azure keys, an AWS secret key with no key name next to it, personal data) pass through. The full list is in docs/architecture/run-capsule.md. A secret in a format the pack claims to detect that survives into a finished capsule is a vulnerability — please report it. A format on the "not detected" list is a feature request.

These exist so an operator can make a deliberate, auditable exception. They were undocumented until 2026-09-10, which is the part that mattered: a control you cannot find is a control you cannot audit, and a deployment review that greps the docs for its own risk surface would have missed all four.

Each accepts 1/true/yes/on.

Already documented elsewhere, listed here so this table is the complete set: NOVAFABRIC_ALLOW_SCHEMA_SKEW, NOVAFABRIC_SELF_TRACE_ALLOW_REMOTE, NOVAFABRIC_SERVER_I_ACCEPT_SHARED_CAPSULE_STORE, and the NOVA_BYPASS_NOTIFY_* family.

If you operate a NovaFabric server, grep your deployment for these names. A set value is not a bug — it is a decision someone made, and it should appear in your change record with a reason.

NovaFabric does not claim to be FIPS 140-3 validated or "FIPS compliant." FIPS 140-3 validation applies to cryptographic modules, not applications. NovaFabric implements no cryptographic primitives of its own: every primitive is delegated to the cryptography package (which calls OpenSSL) and stdlib hashlib/hmac (which use OpenSSL where available). Whether a deployment operates with a validated module is a property of the OpenSSL that deployment links, plus the algorithm caveat below.

No MD5, SHA-1, ChaCha20, or bespoke primitives are used in security-relevant paths.

• The PyPI cryptography wheels statically link their own, non-validated OpenSSL. A FIPS deployment must build cryptography from source against the system OpenSSL 3.x with the FIPS provider installed and enabled; non-approved algorithms then fail at call time instead of silently degrading.
• Stdlib hashlib/hmac ride the same system OpenSSL in CPython builds linked against it.
• Do not install the optional blake3 package (the SHA-256 fallback engages automatically).
• Verifying that the module actually runs in FIPS mode is a deployment responsibility; NovaFabric documents the recipe and certifies nothing. This recipe is documented intent until a FIPS-mode deployment has actually been exercised.

FIPS 186-5 (2023) approves EdDSA including Ed25519, but as of this writing the widely deployed validated OpenSSL FIPS providers (3.0.x line) do not list EdDSA among approved services — check the approved-algorithm list of your specific validated module. Where the module lacks approved EdDSA:

• capsule signing has a FIPS-friendly profile — the ECDSA P-256 DSSE path;
• the ed25519-only surfaces (offline tokens, trust keyring, NovaSeal envelope/ratchet) have no P-256 alternative today and either operate non-approved or are unavailable in a strict FIPS deployment. This is a known, documented gap; algorithm agility for those surfaces would be its own ADR.