Use GitHub's private vulnerability-reporting form:

https://github.com/cinderline/northcinder/security/advisories/new

Do not open a public issue for a vulnerability. Include the affected component, impact, minimal reproduction steps, and a suggested fix when available. Remove credentials, personal data, private logs, and real purchase information from the report.

Never submit:

• raw card data;
• store credentials, browser profiles, service keys, mandate keys, confirmation codes, or approval URLs;
• private audit, profile, order, or mail data; or
• an active exploit against a NorthCinder deployment you do not own or have permission to test.

Security fixes target the current main branch. Reproduce issues against the latest revision when possible.

NorthCinder's mandate gate, nonce ledger, loopback UI, file permissions, content-security policy, and payload validation reduce risk but do not protect local files from another process the buyer runs as the same OS user with arbitrary filesystem access. This is local computer isolation, not access by a NorthCinder-operated host: there is no such host. A buyer can use separate OS accounts when they want stronger isolation between their own AI application and their own NorthCinder process.