We take the security of NoID Privacy seriously. If you discover a security vulnerability, please follow responsible disclosure practices.

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues via one of these methods:

1. GitHub Security Advisory (Preferred)

   • Go to: https://github.com/NexusOne23/noid-privacy/security/advisories
   • Click "Report a vulnerability"
   • Fill out the private security advisory form

2. GitHub Discussions (Private)

   • Create a new discussion in the Security category
   • Mark it as "Private" if possible
   • Provide full details

3. Email (Alternative)

   • Create a discussion requesting secure contact
   • We'll provide a secure communication channel

When reporting a vulnerability, please include:

• Description: Clear description of the vulnerability
• Impact: What can an attacker achieve?
• Affected Versions: Which versions are affected?
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: PoC code if applicable (optional)
• Suggested Fix: If you have one (optional)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7-14 days
  • High: 14-30 days
  • Medium: 30-60 days
  • Low: 60-90 days

We appreciate responsible disclosure! Contributors will be:

• Credited in the CHANGELOG (if desired)
• Listed in the Security Hall of Fame (coming soon)
• Eligible for swag/recognition (for significant findings)

NoID Privacy implements multiple security layers:

• ✅ No External Dependencies: Zero third-party DLLs or executables
• ✅ Code Signing (Planned): Code signing for all PowerShell scripts is planned (coming soon)
• ✅ Verification: 630+ automated compliance checks
• ✅ Rollback: Complete backup & restore functionality

• 🔐 Microsoft Security Baseline 25H2 (425 settings)
• 🛡️ Attack Surface Reduction (19 rules)
• 🔒 Credential Guard* + VBS + HVCI (*Enterprise/Education only)
• 🤖 AI Lockdown (Recall, Copilot, etc.)
• 🌐 DNS-over-HTTPS with no fallback
• 🚫 Zero-Day Protection (CVE-2025-9491 SRP)

Recommendation: Always use the latest v2.x release.

1. ✅ Verify Script Integrity

   # Compare against CHECKSUMS.sha256 from GitHub Release
   Get-FileHash .\NoIDPrivacy.ps1 -Algorithm SHA256
   
   # Or verify the entire release folder:
   Get-ChildItem *.ps1, *.psm1 | ForEach-Object { 
       "$((Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower())  $($_.Name)" 
   }

   Each GitHub release includes a CHECKSUMS.sha256 file with SHA256 hashes of all release files.

2. ✅ Review Code

   • This is open-source - read the code!
   • Understand what changes will be made
   • Check CHANGELOG for recent changes

3. ✅ Create Backup

   • System Restore Point
   • Full system image
   • VM snapshot (if applicable)

• ⚠️ Run as Administrator (required)
• ⚠️ Disable third-party antivirus temporarily (may interfere)
• ⚠️ Close sensitive applications
• ⚠️ Review verification report

• ✅ Run verification: .\Tools\Verify-Complete-Hardening.ps1
• ✅ Review HTML compliance report
• ✅ Test critical applications
• ✅ Keep backups for 30 days

• ⚠️ Local Group Policies may conflict with Domain GPOs
• ⚠️ Domain GPOs override local policies every 90 minutes
• ✅ Recommendation: Use in standalone/workgroup systems only

• ⚠️ ASR rules may block unknown installers
• ⚠️ Some hardening settings may affect application functionality
• ✅ Solution: Temporarily disable specific ASR rules (see README)

• ⚠️ Bloatware removal is partially reversible (policy-based on 25H2+ Enterprise/Education)
• ⚠️ Some changes require manual reverification after restore
• ✅ Solution: Test in VM first, maintain system backups

• Microsoft Security Baseline: https://aka.ms/securitybaselines
• Attack Surface Reduction: https://aka.ms/ASRrules
• Windows Security Documentation: https://learn.microsoft.com/windows/security/

• PSScriptAnalyzer: Available for static analysis
• Pester Tests: Unit and integration tests available in Tests/ directory
• Verification: 630+ automated compliance checks in production

Run tests yourself:

.\Tests\Run-Tests.ps1

No security vulnerabilities reported to date.

• License: GNU General Public License v3.0
• Disclaimer: Use at your own risk. No warranties provided.
• Compliance: Implements Microsoft-recommended security settings

For licensing questions, see LICENSE or open a Discussion.

Last Updated: December 22, 2025
Policy Version: 1.1