Skip to content

Trust

Security

How to report an issue, what we commit to, and what runs in your shipped product.

Report a vulnerability

If you believe you've found a security issue in Nebula.NET, please tell us before disclosing it publicly. Email security@delta1labs.com with:

  • • a description of the issue and its potential impact,
  • • the Nebula.NET version affected, and
  • • steps (or a proof of concept) to reproduce it.

What we commit to

  • We acknowledge every report within 2 business days.
  • We investigate promptly and keep you updated on our assessment and a fix timeline.
  • We practice coordinated disclosure — we'll agree a disclosure date with you and credit you if you'd like.
  • We patch supported (non-end-of-life) versions and notify affected customers directly.

Good-faith safe harbor

We won't pursue or support legal action against researchers who act in good faith: test only against your own installations, avoid privacy violations and service disruption, and give us reasonable time to fix an issue before disclosing it.

Our security commitments

Patches for the version you own

Critical security and bug-fix patches are provided for supported (non-end-of-life) versions even without an active support plan. We email licensed contacts directly about critical security releases, so you'll always know a fix exists. See the Support SLA for details.

What runs in your shipped product

Nebula's standard protections inject only managed code into your own assembly — your product gains no runtime dependency on Nebula, and the injected code uses no native/OS calls, makes no network calls, and sends no telemetry from your users' machines. (The one optional exception, whole-method encryption, ships a small local runtime component and is off by default.) The only network activity is the build-time license check inside the obfuscator itself — it is never emitted into your product.

Verify what you download

Every release on the download page lists a SHA-256 you can check against your download, and shipped builds are Authenticode-signed.