Nick operates on security-sensitive macOS data and includes privileged and system-extension components. Please report suspected vulnerabilities privately. Do not open a public issue for a vulnerability, exploit, credential, signing material, or malware sample.

Only artifacts published through the official GitHub Releases page or the Nick update feed are supported. Source builds and modified packages are outside the release support boundary.

Use one of these private channels:

1. Open a private GitHub security advisory
2. Email security@3nsofts.com

Include, when possible:

• the affected Nick and macOS versions;
• the affected component and expected security boundary;
• reproduction steps or a minimal proof of concept;
• impact and prerequisites;
• relevant logs with personal data and secrets removed.

Do not attach live malware to an issue or email. Coordinate sample transfer privately after acknowledgment.

• Initial acknowledgment: within 2 business days.
• Initial severity assessment: within 7 calendar days.
• Status updates for confirmed high-severity issues: at least every 14 days.

These are response targets, not guaranteed remediation deadlines. Resolution time depends on complexity, Apple platform behavior, and whether entitlement or operating-system changes are required.

Please allow reasonable time for investigation and release preparation before public disclosure. Nick will credit reporters who request attribution and will coordinate disclosure timing for confirmed vulnerabilities.

• Architecture and trust boundaries
• Detailed security audit record
• Release verification checklist

The audit record documents historical findings and remediations. It is not a certification, warranty, or claim that Nick detects every threat.