Loading
This is one developer’s project. Everything below is a real route that gets read, and none of it carries a promised response time, because there is nobody to promise it on.
A report for this product is unusually likely to contain production data, and a GitHub issue is public.
Do not paste real prompts, real tool arguments, real retrieved documents, real audit rows or real trace payloads. Replace names, account numbers, URLs and secrets with obvious placeholders. A reduced reproduction with made-up values is more useful than a real one, because it can be run here.
nometria doctorGrades the runtime configuration and the quality of your tool declarations. It explains a surprising verdict on its own often enough to be worth running first.
nometria versionEvery template asks for it. The first line is enough, or the commit SHA if you run from a clone.
nometria policy listPrints which packs are bound and whether each is in observe or enforce. A verdict report is hard to read without it.
Blank issues are switched off, so the form you pick is the form that gets you the right questions.
| What happened | Where it goes | What it asks for |
|---|---|---|
| It crashed, hung, or contradicted the docs | Bug report | Command and output, version, how you run it, Python and OS, extras. |
| It blocked something legitimate | Wrong verdict | Trace id, rule id, pack and mode, the surface, what the decision said. |
| It allowed something it should have stopped | Wrong verdict | Same fields. A detector missing an injection belongs here, not in an advisory. |
| The product cannot do a thing you need | Feature request | What you were governing and where it ran out of road, not a wish list. |
| How do I, is this the right tool, does this design hold | Discussions | Questions and ideas, so the issue tracker stays a list of things to fix. |
| You found a vulnerability | SECURITY.md, privately | Never a public issue. The route is in SECURITY.md and only there. |
A false positive costs you an afternoon. A false negative is the thing the product exists to prevent. Both are worth filing, and there is a template just for them.
The trace id and the rule id are what is needed. The payload usually is not, so redact it and keep the structure.
Which way it went wrong, the trace id, the rule id, the policy pack and its mode, and which surface was being checked: input, output, tool arguments, tool result, a memory write or an agent message.
The tool’s impact tier and the capability grant that applied. Containment is exactly as good as the declarations behind it, so a surprising verdict is often a declaration rather than a detector.
A prompt injection a detector missed goes here, not through the private advisory route. SECURITY.md says so itself: detection is a speed bump, not a defence.
Please do not open a public issue for a security problem, and please do not email the details either. SECURITY.md holds the private reporting route, what is in scope, and the two things this project says in public are not vulnerabilities.
It is the only description of that process, deliberately. A second copy is a chance for someone to follow the out-of-date one.
The identical software, plus help with rollout and priority on fixes. It is not priced yet.
GitHub Issues and Discussions, read and answered on a best-effort basis by one developer. No service level, and no promised response time.
A support relationship rather than different software. Email support@nometria.com and say what you are rolling out.
In development. It does not exist and you cannot sign up today. The editions are laid out on the pricing page.
Most questions have an answer in one of these four, and they are all faster than waiting on a reply.
docs/getting-started.md goes from an empty directory to one of your own agents under enforcement. Every command in it was run before it was written down.
How it works is the public explanation, and the product page walks each layer on a real screen.
The glossary defines provenance, impact tiers, grants and the rest. It lives inside the dashboard, so it asks you to sign in.
The harness packages the product as skills, commands, subagents and safety hooks, so an agent can do the setup without learning 17 CLI groups first.