Report vulnerabilities through GitHub private vulnerability reporting: https://github.com/Quad4-Software/netbirdy/security/advisories/new

Do not open a public issue for a suspected vulnerability.

Only the latest release is supported. Update before reporting issues in older versions.

In scope: management server, client (netbirdy), signal and relay, reverse proxy and its shield, the anomaly detection engine, the dashboard, and the Podman preview stack.

Out of scope: third-party integrations deployed separately (Pocket ID, Quad4 ID, Wazuh), social engineering, denial of service against upstream upstream NetBird infrastructure. Bugs that are upstream issues should also be reported to the upstream NetBird project.

Reports get an acknowledgement within a few days. Timelines for fixes depend on severity and are not guaranteed. Credit is given in release notes unless you opt out.