fix handling of empty network map during decode and encode

## Describe your changes

## Issue ticket number and link

## Stack

<!-- branch-stack -->

### Checklist
- [ ] Is it a bug fix
- [x] Is a typo/documentation fix
- [ ] Is a feature enhancement
- [ ] It is a refactor
- [ ] Created tests that fail without the change (if possible)
- [ ] This change does **not** modify the public API, gRPC protocols,
functionality behavior, CLI / service flags, or introduce a new feature
— **OR** I have discussed it with the NetBird team beforehand (link the
issue / Slack thread in the description). See
[CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first).

> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).

## Documentation
Select exactly one:

- [ ] I added/updated documentation for this change
- [x] Documentation is **not needed** for this change (explain why)

### Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Expanded the security vulnerability reporting policy with private
reporting options and guidance for hosted infrastructure issues.
* Added recommendations for report contents, acknowledgements, severity
assessment, remediation, advisories, and reporter credit.
* Clarified supported versions, advisory distribution, bug bounty
status, and where to report non-security issues.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

SECURITY.md

@@ -1,12 +1,70 @@
 # Security Policy
 
-NetBird's goal is to provide a secure network. If you find a vulnerability or bug, please report it by opening an issue [here](https://github.com/netbirdio/netbird/issues/new?assignees=&labels=&template=bug-issue-report.md&title=) or by contacting us by email.
-
-There has yet to be an official bug bounty program for the NetBird project.
-
-## Supported Versions
-- We currently support only the latest version
+NetBird's goal is to provide a secure network. The client runs as a privileged service on every machine it is installed on,
+so we take reports about it seriously and we publish what we fix.
 
 ## Reporting a Vulnerability
 
-Please report security issues to `security@netbird.io`
+**Please do not open a public issue for a security vulnerability.** Public issues are visible to everyone, including before
+a fix is available.
+
+Report security issues one of these two ways:
+
+- **GitHub private vulnerability reporting** — [open a private report](https://github.com/netbirdio/netbird/security/advisories/new)
+  on this repository. This is the preferred route: it keeps the discussion, the draft advisory, and the credit in one place.
+- **Email** — `security@netbird.io`.
+
+If the finding affects NetBird Cloud or our hosted infrastructure rather than the open-source code, email us rather than
+filing a repository report.
+
+### What to include
+
+A report is easier to act on when it contains:
+
+- The affected component (client, management, signal, relay, dashboard) and the version or commit you tested
+- The platform and configuration, where relevant — operating system, self-hosted or NetBird Cloud, container or host install
+- What an attacker needs before they can exploit it: network position, an account, local access, a specific privilege level
+- Steps to reproduce, and a proof of concept if you have one
+- The impact you believe it has
+
+Partial reports are still welcome. If you are unsure whether something is a security issue, send it to `security@netbird.io`
+and let us make that call.
+
+## What to expect from us
+
+- **We acknowledge your report** and tell you whether we can reproduce it.
+- **We work with you on severity and scope.** If we assess it differently than you do, we will explain why rather than
+  silently downgrade it.
+- **We fix and release**, then publish a [GitHub Security Advisory](https://github.com/netbirdio/netbird/security/advisories)
+  naming the affected version range and the patched version.
+- **We credit reporters who want to be credited.** Tell us the name or handle you would like used, or that you would rather
+  stay anonymous.
+- **We keep you in the loop** until the advisory is published.
+
+We ask that you give us a reasonable opportunity to ship a fix before disclosing the issue publicly, and that you avoid
+accessing, modifying, or exfiltrating data belonging to other people while testing. Testing against your own installation
+or your own account is always fine.
+
+## Supported Versions
+
+We support the latest release. Security fixes ship in the next version rather than as backports to older releases, so
+upgrading to the current release is how you get them.
+
+Release notifications are available by watching [releases](https://github.com/netbirdio/netbird/releases).
+
+## Published advisories
+
+Every vulnerability we fix is published as a GitHub Security Advisory on the
+[advisories page](https://github.com/netbirdio/netbird/security/advisories), including the affected version range, the
+patched version, and the reporter's credit. Advisories for the Go module are also distributed through the Go vulnerability
+database, so `govulncheck` will report them against your dependencies.
+
+## Bug bounty
+
+There is no official bug bounty program for the NetBird project. We credit reporters in advisories, and we are grateful for
+the work, but we cannot currently offer payment for reports.
+
+## Non-security bugs
+
+For bugs that are not security issues, please use the
+[issue tracker](https://github.com/netbirdio/netbird/discussions/new/choose).

client/server/login_outcome_test.go

@@ -1,89 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A login that never reached Management is not a decision about the peer's
-// credentials, so it must come back as a retryable error rather than an SSO
-// prompt: the user cannot finish a browser login while Management is down, and
-// the CLI's own backoff resolves the outage on its own once the daemon reports
-// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
-// because Management happened to be restarting when the daemon dialed it.
-func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	unreachable := errors.New("create connection: dial context: context deadline exceeded")
-	attempts := 0
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		attempts++
-		return internal.StatusLoginFailed, unreachable
-	}
-
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
-	require.Nil(t, resp, "a failed login must not answer with a login response")
-	require.Equal(t, 1, attempts)
-	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"a peer that could not reach Management is not waiting on a login")
-}
-
-// The counterpart: Management refusing the peer's credentials is a decision, and
-// the SSO flow still has to start for it. The profile carries an unusable
-// private key so the flow setup fails immediately instead of dialing, which is
-// enough to show the branch was entered — the refusal itself is never what comes
-// back out.
-func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
-	s, _, _, username, cfgPath := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-	breakProfilePrivateKey(t, cfgPath)
-
-	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		return internal.StatusNeedsLogin, refused
-	}
-
-	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.NotErrorIs(t, err, refused,
-		"the refusal was handed back to the caller instead of starting the SSO flow")
-
-	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, stateErr)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"the SSO flow setup was never reached with the broken key")
-}
-
-// breakProfilePrivateKey replaces the profile's private key with an unparseable
-// one, which makes any attempt to build a Management client fail on the spot.
-func breakProfilePrivateKey(t *testing.T, cfgPath string) {
-	t.Helper()
-
-	raw, err := os.ReadFile(cfgPath)
-	require.NoError(t, err)
-
-	var cfg map[string]any
-	require.NoError(t, json.Unmarshal(raw, &cfg))
-	cfg["PrivateKey"] = "not-a-key"
-
-	patched, err := json.Marshal(cfg)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
-}

client/server/server.go

@@ -132,11 +132,6 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
-
-	// loginAttemptFn stands in for the Management login round trip. Tests set
-	// it to drive the login outcomes that need a server on the other end;
-	// production leaves it nil, and every login goes through loginAttempt.
-	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
 }
 
 type oauthAuthFlow struct {
@@ -372,19 +367,7 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// attemptLogin runs a login round trip against Management, or the stand-in a
-// test installed in place of it.
-func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
-	if s.loginAttemptFn != nil {
-		return s.loginAttemptFn(ctx, setupKey, jwtToken)
-	}
-	return s.loginAttempt(ctx, setupKey, jwtToken)
-}
-
-// loginAttempt attempts to login using the provided information. It returns
-// StatusNeedsLogin when Management refused the peer's credentials and
-// StatusLoginFailed for every other failure, so callers can tell an
-// authentication decision apart from a login that never got made.
+// loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -633,23 +616,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	loginStatus, err := s.attemptLogin(ctx, "", "")
-	if err == nil {
+	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
 
-	// Only an authentication refusal means the peer has to (re-)authenticate.
-	// Any other failure leaves the login undecided: Management unreachable, a
-	// restart mid-request, an internal error. Those are returned for the caller
-	// to retry, because turning them into an SSO prompt asks the user to solve
-	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway.
-	if loginStatus != internal.StatusNeedsLogin {
-		state.Set(loginStatus)
-		return nil, err
-	}
-
 	if msg.SetupKey == "" {
 		hint := ""
 		if msg.Hint != nil {
@@ -706,7 +677,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -861,7 +832,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}

client/ui/netbird-ui.rb.tmpl

@@ -29,8 +29,13 @@ cask "{{ $projectName }}" do
   end
 
   uninstall_preflight do
-    system_command "#{appdir}/Netbird UI.app/uninstaller.sh",
-                   sudo: false
+    system_command "/bin/sh",
+                   args: ["-c", <<~CMD],
+                     launchctl bootout system/netbird 2>/dev/null || \
+                       launchctl unload /Library/LaunchDaemons/netbird.plist 2>/dev/null || true
+                     rm -f /Library/LaunchDaemons/netbird.plist
+                   CMD
+                   sudo: true
   end
 
   name "Netbird UI"

management/internals/shared/grpc/components_encoder.go

@@ -61,6 +61,8 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
+					Serial:     networkSerial(c.Network),
+					Network:    toAccountNetwork(c.Network),
 					PeerConfig: in.PeerConfig,
 					// components.Peers always contains the target peer
 					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},

management/internals/shared/grpc/components_encoder_test.go

@@ -758,6 +758,9 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	assert.Equal(t, "netbird.cloud", full.DnsDomain)
 	assert.Len(t, full.Peers, 1)
 	assert.Empty(t, full.Policies)
+	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
+	assert.Equal(t, "net-empty", full.Network.Identifier)
+	assert.Equal(t, uint64(9), full.Serial)
 }
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
@@ -776,6 +779,12 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}},
+			Network: &types.Network{
+				Identifier: "net-empty",
+				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+				Serial:     9,
+			},
+		},
 	)
 }

shared/management/networkmap/decode.go

@@ -228,15 +228,17 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	return c, nil
 }
 
+// decodeAccountNetwork never returns nil — Calculate() dereferences
+// c.Network unconditionally, and servers that predate the fix omit the field
+// entirely from the empty-components envelope.
 func decodeAccountNetwork(an *proto.AccountNetwork) *types.Network {
+	n := &types.Network{}
 	if an == nil {
-		return nil
-	}
-	n := &types.Network{
-		Identifier: an.Identifier,
-		Dns:        an.Dns,
-		Serial:     an.Serial,
+		return n
 	}
+	n.Identifier = an.Identifier
+	n.Dns = an.Dns
+	n.Serial = an.Serial
 	if an.NetCidr != "" {
 		if _, ipnet, err := net.ParseCIDR(an.NetCidr); err == nil && ipnet != nil {
 			n.Net = *ipnet

shared/management/networkmap/envelope_test.go

@@ -221,6 +221,66 @@ func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 		"client-side Calculate must connect the same remote peers as the server")
 }
 
+// TestEnvelopeToNetworkMap_EmptyComponents covers the graceful-degrade path
+// the server takes for a peer that is missing from the account or absent from
+// the validated-peers map. The legacy server short-circuited before
+// Calculate() and shipped a NetworkMap carrying only the account Network; the
+// components path runs Calculate() on the client instead, so the envelope must
+// carry Network or the client panics dereferencing a nil *types.Network.
+func TestEnvelopeToNetworkMap_EmptyComponents(t *testing.T) {
+	localPeerKey := randomWgKey(t)
+	c := types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
+		PeerID: "peer-A",
+		Network: &types.Network{
+			Identifier: "net-empty",
+			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+			Serial:     7,
+		},
+		Peers: map[string]*types.ComponentPeer{
+			"peer-A": {ID: "peer-A", Key: localPeerKey, IP: netip.AddrFrom4([4]byte{100, 64, 0, 1})},
+		},
+	})
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	require.NotNil(t, envelope.GetFull().Network, "empty envelope must carry the account Network")
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
+	require.NoError(t, err, "EnvelopeToNetworkMap must degrade gracefully on empty components")
+	require.Equal(t, uint64(7), result.NetworkMap.Serial)
+	require.Empty(t, result.NetworkMap.RemotePeers, "unvalidated peer connects to nobody")
+}
+
+// TestEnvelopeToNetworkMap_MissingNetwork simulates a server that omits
+// AccountNetwork from the envelope. Clients must degrade rather than panic, so
+// they survive talking to a management server that predates the encoder fix.
+func TestEnvelopeToNetworkMap_MissingNetwork(t *testing.T) {
+	c, localPeerKey := buildSmokeComponents(t)
+
+	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
+		Components: c,
+		DNSDomain:  "netbird.cloud",
+	})
+	envelope.GetFull().Network = nil
+
+	wire, err := goproto.Marshal(envelope)
+	require.NoError(t, err, "marshal envelope")
+	var decoded proto.NetworkMapEnvelope
+	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
+
+	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
+	require.NoError(t, err, "a missing AccountNetwork must not panic the client")
+	require.NotNil(t, result.Components.Network)
+	require.NotEmpty(t, result.NetworkMap.RemotePeers, "the rest of the snapshot stays usable")
+}
+
 // buildSmokeComponents returns a minimal NetworkMapComponents (2 peers, 1
 // group, 1 allow policy) plus the receiving peer's WG public key. Sufficient
 // to validate the encode → marshal → decode → Calculate pipeline produces