The nervly CLI is the local half of Nervly's developer surface: it detects the environment, manages a local SOPS/age secret store, forwards delivery webhooks to a developer's own receiver, and holds console sessions in the OS keychain. A vulnerability here can leak the developer's own secrets, forge or replay a forwarded webhook, or cause an install to trust an artifact it should not. We welcome reports from independent researchers and from anyone who depends on the CLI.

For the hosted platform (api.nervly.io, app.nervly.io, cross-tenant isolation, billing, and the rest of the service), see the platform policy at ../nervly-base/SECURITY.md. This document covers the published binary, the local stores it manages, and the npm/Homebrew distribution channels.

Do not open a public GitHub issue, pull request, or discussion for a security problem.

Email security@nervly.io with a description of the issue and the steps to reproduce it. If you prefer encrypted email, ask for our PGP key in your first message and we will reply with it.

Please include, where you can:

• The affected version (nervly --version), platform (macOS, Linux, Windows; architecture) and install channel (npm, Homebrew, cargo install, or a release archive).
• A description of the vulnerability and its impact.
• A minimal reproduction or proof-of-concept.
• Any conditions required to exploit it (a crafted relay event, a malicious .env, a local attacker, a specific receiver).

Do not test against the production service with real credentials, and do not forward real delivery traffic to a receiver you do not control. A Test mode API key (nervly_sk_test_...) and the local/test environments exist for verifying findings against your own workspace.

We will keep you informed, tell you if we cannot reproduce the issue, and credit you in the CHANGELOG.md entry for the fix unless you ask us not to. Release archives ship with sha256 checksums signed keyless with cosign, and each release attaches a CycloneDX SBOM, so a fix's artifacts are verifiable back to the tagged commit.

We follow coordinated disclosure. We ask that you give us a reasonable window to ship a fix before publishing your findings, and we will not take legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, and service degradation.
• Only interact with accounts, workspaces, and machines they own or have explicit permission to test.
• Do not exfiltrate data, pivot into other tenants, or use social engineering against Nervly staff or customers.
• Report promptly and do not exploit a finding beyond what is needed to demonstrate it.

This is a safe-harbour statement: activity conducted in line with the above is authorised, and we will not pursue or support legal action against you for it.

• The published nervly binary and its signed/checksummed release artifacts (per-target archives, checksums.txt, the cosign signature, and the attached CycloneDX SBOM).
• The local secret store: the SOPS/age-compatible format, its authenticated encryption, and its 0600 file handling.
• Console-session handling: the device-code login, the OS-keychain storage, and the management/data-plane authorization boundary.
• Relay and forwarding: the tunnel client, local HMAC-SHA256 re-signing, at-least-once delivery, and the no-synthesis guarantee.
• The npm and Homebrew distribution channels: the launcher, the platform packages, provenance, and the formula update pipeline.
• Credential handling: API keys or secrets reaching logs, argv, telemetry, or --json output.

• The hosted Nervly platform and its APIs (api.nervly.io, sandbox-api.nervly.io, the relay, and the rest of the service) — report those under the platform policy.
• Findings that require a compromised device, a malicious browser extension, or physical access.
• Volumetric denial-of-service and resource-exhaustion testing without prior written agreement.
• Reports generated solely by an automated scanner with no demonstrated impact.
• Third-party providers' own platforms (for example GitHub, npm, Homebrew, or crates.io) — report those to the provider.

The CLI is distributed from a single line; the latest release is the supported version. Pre-1.0, the command surface is unstable but security fixes still land as patch releases on the current minor. Each release is recorded in CHANGELOG.md.