Security disclosure

The Foundation maintains a disclosure channel for findings that affect its specifications, its registry operations, or its open-source verifier library, and follows a coordinated-disclosure practice.

Report a finding. Email contact@nfid.foundation with a subject line that starts with “Security”. Include the affected specification or component, a description, and reproduction steps where applicable.

What to expect. Acknowledgment within 5 business days. An initial assessment within 15 business days. Coordinated public disclosure at 90 days from report, or earlier by agreement, or later where a fix requires coordination across implementers.

Scope. Specification defects with security consequences; the Foundation’s registry operations; the verifier library. Implementations by third parties are reported to the implementer, and the Foundation will help route a report when asked.