Security

SECURITY.md

Security Policy

Report security issues privately to the repository owner.

Do not open public issues for vulnerabilities involving credential exposure, certificate issuance bypasses, or workflow injection.

Credential Handling

Never commit NKS_API_KEY.
Store NKS API keys in GitHub Actions secrets.
Prefer CI-scoped NKS keys with short access windows.
Treat generated private keys as runner-local secrets.

The action sends only the raw Ed25519 public key to NKS. The private key remains on the runner.

There aren't any published security advisories