NEAXCE is a VPN engine — bugs in it can leak traffic, expose user addresses, or enable downgrade attacks. Please do not file public GitHub issues for security-sensitive findings.

Instead, open a private security advisory on this repository. Include:

• a description of the issue and its impact,
• a reproduction (PoC code, sample packets, or a trace is ideal),
• the affected commit / tag, and
• any mitigation you're aware of.

We aim to acknowledge reports within 7 days and to ship a fix (or a time-boxed remediation plan) within 60 days. Coordinated disclosure is welcome.

In scope:

• the Swift engine in Sources/NEAXCE/ (crypto, codecs, DNS, transports, provider lifecycle),
• the C layer in Sources/CLwIP/LwIPHelpers.c and the Swift/C boundary (improper pointer handling, use-after-free),
• the port-specific lwIP configuration in Sources/CLwIP/include/lwipopts.h,
• documented public APIs in README.md.

Out of scope (report upstream or in regular issues):

• bugs in the unmodified lwIP source under Sources/CLwIP/core/ — report at lwIP Savannah,
• flaws in server-side Xray deployments,
• issues that require a malicious host app (the threat model assumes the app and extension are cooperating).

• Reality's XTLS vision flow is not fully implemented; traffic fingerprinting on that transport is expected until it lands.
• HTTP/2 connection reuse is not implemented, which surfaces more TLS fingerprints than necessary per user session.

These are tracked in the issue tracker and called out in README.md.