Norcaster · Trust center

Responsible disclosure

Help us keep Norcaster and our customers safe. We appreciate coordinated disclosure.

If you discover a security vulnerability affecting Norcaster, please report it responsibly. Do not open a public GitHub issue for security issues.

How to report

  1. Email security@norcaster.com with a description and steps to reproduce.
  2. Include impact assessment and any proof-of-concept if available.
  3. Allow reasonable time for remediation before public disclosure (we aim for 90 days or less).

Encrypted reports

For sensitive findings, request our PGP public key in your initial email to security@norcaster.com. We will provide the current key on request.

What to expect

  • Acknowledgement of your report within a few business days.
  • Updates as we investigate and ship fixes.
  • Credit in release notes or advisories if you wish (with your permission).

Machine-readable version of this policy (RFC 9116): /.well-known/security.txt

Security overview →