"Holy Ground is sanctuary. No Immortal may fight on Holy Ground."

The Nash Group takes security as seriously as an Immortal guards their head. This document outlines our security policies and procedures for reporting vulnerabilities.

Like the sacred rules that govern Immortals, our security principles are inviolate:

1. Zero Trust - Trust no one, verify everything
2. Defense in Depth - Multiple layers of protection, like chainmail beneath armor
3. Least Privilege - Grant only the power absolutely necessary
4. Immutable Audit - Every action is chronicled, every event recorded
5. Rapid Response - Swift as a blade when threats emerge

We provide security updates for the following versions:

Versions not listed above are considered end-of-life and will not receive security updates.

If you discover a security vulnerability within The Nash Group's realm, we appreciate your help in disclosing it responsibly.

DO NOT create a public GitHub issue for security vulnerabilities.

Report security vulnerabilities through one of these channels:

1. GitHub Security Advisories (Preferred)

   • Navigate to the affected repository
   • Click "Security" → "Report a vulnerability"
   • Fill out the security advisory form

2. Encrypted Email

   • Email: security@thenashgroup.dev
   • PGP Key: Download our PGP key
   • Key Fingerprint: XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX

Your report should contain:

## Vulnerability Report

**Affected Service:** [e.g., The Gathering v2.1.3]
**Severity Assessment:** [Critical/High/Medium/Low]
**Attack Vector:** [Network/Local/Physical]

### Description
[Clear description of the vulnerability]

### Steps to Reproduce
1. [First step]
2. [Second step]
3. [Observe vulnerability]

### Proof of Concept
[Include code or screenshots if applicable]

### Impact Assessment
[What can an attacker achieve?]

### Suggested Remediation
[If you have suggestions for fixing]

### Reporter Information
- Name/Handle: [Your name or handle]
- Affiliation: [If applicable]
- Contact: [How we can reach you]

Our incident response follows The Quickening Protocol:

• 💀 Critical: Remote code execution, authentication bypass, data breach
• 🗡️ High: Privilege escalation, significant data exposure
• ⚔️ Medium: Limited data exposure, denial of service
• 🛡️ Low: Information disclosure, non-exploitable issues

We believe in recognizing those who help us maintain Holy Ground:

Security researchers who responsibly disclose vulnerabilities will be:

• Added to our Hall of Guardians (with permission)
• Acknowledged in security advisories
• Eligible for Nash Group swag

While we don't currently offer monetary rewards, we're evaluating a bug bounty program. Check back for updates.

• Regular Security Audits: Quarterly third-party assessments
• Dependency Scanning: Automated daily scans for vulnerable dependencies
• Code Analysis: Static analysis on every commit
• Penetration Testing: Annual pen testing by certified professionals
• Secrets Management: All secrets stored in Holy Ground (Infisical)
• Encryption: TLS 1.3+ for transit, AES-256 for storage
• Access Control: Multi-factor authentication required
• Monitoring: 24/7 security monitoring through The Quickening

All Nash Group services implement:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()

The Nash Group maintains compliance with:

• OWASP Top 10 mitigation strategies
• CIS Controls
• NIST Cybersecurity Framework

All Immortals (developers) must:

1. Complete security onboarding within first week
2. Attend quarterly security training
3. Pass annual security certification
4. Participate in security game days

We publish quarterly transparency reports including:

• Number of vulnerabilities reported
• Average time to resolution
• Security incidents (if any)
• Improvements implemented

Find our reports at: The Chronicles - Security Reports

We request that you:

1. Give us reasonable time to address the issue before public disclosure
2. Avoid accessing or modifying user data without permission
3. Avoid degradation of our services
4. Not exploit vulnerabilities beyond POC development

In return, we commit to:

1. Respond quickly and professionally
2. Keep you informed of our progress
3. Credit you for your discovery (unless you prefer anonymity)
4. Not pursue legal action for good-faith security research

• Security Issues: security@thenashgroup.dev
• General Inquiries: hello@thenashgroup.dev
• Status Page: https://status.thenashgroup.dev

"By reporting vulnerabilities responsibly, you join the ranks of those who guard Holy Ground. Your vigilance ensures that The Nash Group remains an unbreachable fortress, standing eternal against the forces of chaos."

Last Updated: November 2024
Next Review: February 2025

"On Holy Ground, we're all safe."