Security

Report a vulnerability

Write privately to admin@projectnjol.com with subject “njol security”. Include the njol and Windows versions, impact and reproduction steps using test data. Say if exploitation is suspected. Never attach passwords, session tokens, real profiles or other people’s data. For sensitive details, first request an appropriate exchange method; no public encryption key is currently advertised. This contact is not permission to attack third-party services.

Current status

Use current Windows, WebView2 and njol versions. This beta has no security certification or guaranteed bug-bounty payment. Reports are handled manually; an automatic acknowledgement or response SLA is not promised. The project has not completed its regulatory assessment, including Cyber Resilience Act applicability. Being free or labelled beta is not a compliance exemption. Security notices and fixes will be described in the official BOREALIS or NORDIC 5 release notes when available.

Two products, different checks

Identify BOREALIS and the browser version, or NORDIC 5 and the affected launcher, Core and Skellig versions. BOREALIS releases · NORDIC 5 releases. Please coordinate handling before publishing details that enable exploitation.

BOREALIS verifies a project-signed update manifest. NORDIC 5 compares hashes with GitHub release metadata and checksums; this is not an independent publisher signature. Neither reviewed download is Authenticode-signed. A hash or antivirus scan does not certify security or compliance. Provider infrastructure and publishing accounts are part of the trust chain.