Report suspected vulnerabilities privately to Novvor. Do not open public issues containing credentials, launch codes, assertions, tenant identifiers, or exploit details.

The SDK deliberately:

• requires HTTPS and validates certificates;
• disables HTTP redirects;
• signs authenticated requests with timestamp, nonce, and HMAC-SHA256;
• validates Central launch assertions with RS256 and JWKS;
• binds assertions to the configured issuer and application audience;
• binds entitlement responses to the requested tenant and application;
• never stores or logs the application credential.

Applications remain responsible for storing credentials in a secret manager, rotating them, enforcing least privilege scopes, and mapping Central identities to local users without elevating privileges.