Nautilus follows the version in pyproject.toml; the current release is named in the README.

Configuration guidance — credentials, TLS termination, capability scoping, keeping /metrics and /admin off a public listener — lives in docs/how-to/hardening.md. A misconfiguration you can fix from that guide is not a vulnerability report; a control that does not hold when configured as documented is.

Use GitHub's private vulnerability reporting: Security tab → Advisories → Report a vulnerability

Acknowledge 48h, assess 7 days, fix critical within 30 days