# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 1.x     | :white_check_mark: |

Only the latest release is supported. Older versions should upgrade before
reporting issues.

## Reporting a Vulnerability

NitroCore modifies Windows system settings, so security reports are taken
seriously.

**Do not open a public issue for a suspected vulnerability.** Instead, email:

**sentinelsafeguard@outlook.com**

Include:
- A description of the issue and its potential impact
- Steps to reproduce (if applicable)
- The NitroCore version you tested

You can expect an acknowledgment within 72 hours. If the issue is confirmed,
a fix will be prioritized and you will be credited in the release notes
(unless you prefer to remain anonymous).

## Scope Notes

- NitroCore is open source (MIT). Every release ships with SHA256 hashes so
  you can verify your download.
- Release binaries are currently **unsigned** (M-7) — Windows SmartScreen will
  warn on first run; verify the SHA256SUMS.txt before trusting the binary.
  Code signing is a planned manual release step.
- NitroCore collects no telemetry and makes no network connections. If you
  ever observe unexpected network activity from a NitroCore binary, treat it
  as a security issue and report it immediately — it is not intended behavior.