This policy applies to all packages maintained under the pkg-nec GitHub organization (@pkg-nec/* on npm).

pkg-nec exists specifically to provide security patches for unmaintained upstream packages. Security is our primary concern.

We support the latest published version of each package. We do not backport fixes to older versions.

Please do not report security vulnerabilities in public GitHub issues.

Report vulnerabilities privately via GitHub Security Advisories:

1. Go to the affected repository (e.g., pkg-nec/http-server)
2. Click Security → Advisories → Report a vulnerability
3. Fill in the details — CVE reference (if known), affected versions, reproduction steps, and impact

We will acknowledge your report within 72 hours and aim to publish a patch within 14 days for confirmed vulnerabilities. We will credit reporters in the advisory unless you request otherwise.

If a vulnerability originates in the upstream unmaintained package (e.g., http-party/http-server) and has not been patched there, please report it to us directly — that is exactly why this organization exists.

If you identify a vulnerable dependency via npm audit or a similar tool, please open a private advisory or a public issue (if the dependency is already publicly known to be vulnerable). We prioritize dependency updates that address known CVEs.

For non-vulnerability security questions, open a discussion in the relevant repository.