Security
We take the security of Nexus seriously. Nexus runs with deep access to your hardware, so a vulnerability in the app or our services matters more than average. If you have found one, we want to hear from you, and we will treat you well for telling us.
For a technical overview of how Nexus is built to be secure - the local trust boundaries, device pairing, and the end-to-end-encrypted remote-access relay with NAT punch-through - see How Nexus Secures Your PC.
Scope
In scope for security research:
- hellonexus.com
- my.hellonexus.com
- api.hellonexus.com
- The Nexus desktop app (Windows, macOS, and Linux), including its local service, pairing, and relay features
Out of scope:
- Denial-of-service or volumetric testing against our services
- Social engineering, phishing, or physical attacks against people who work on Nexus
- Vulnerabilities in third-party platforms we build on (Cloudflare, Railway, Resend, PostHog, GitHub); report those to the vendor
- Findings that require a victim to already be fully compromised (for example, malware already running as administrator on the victim's machine)
If you are unsure whether something is in scope, ask us first.
How to report
Email [email protected] with:
- What you found and where (URL, endpoint, app version).
- Steps to reproduce, or a proof of concept.
- What you think the impact is.
- How you would like to be credited, if you would.
We also publish a security.txt at https://hellonexus.com/.well-known/security.txt with this contact information in machine-readable form.
Please report privately and give us time to fix the issue before any public disclosure. We are happy to coordinate a disclosure timeline with you.
Safe harbor
We will not pursue legal action or refer you to law enforcement for security research done in good faith under this policy. Good faith means:
- You stay within the scope above.
- You access, modify, or retain only the minimum data needed to demonstrate the issue, and you do not access other people's accounts or data beyond what a proof of concept strictly requires.
- You do not degrade the service for other users or destroy data.
- You report the issue promptly and do not exploit it beyond demonstration.
- You keep the details private until we have fixed the issue or agreed on a disclosure date.
For research that meets these conditions, we consider it authorized under applicable anti-hacking and anti-circumvention laws, and we waive claims we could otherwise bring for that research. If a third party takes legal action against you for research conducted under this policy, we will make it known that your actions were authorized.
Bounties
We do not run a paid bug bounty program at this time. We will credit you in our release notes if you want, and we say thank you and mean it.
What to expect from us
- Acknowledgment of your report within 3 business days.
- An assessment and severity triage within 10 business days.
- Regular updates while we work on a fix, and a heads-up when it ships.
- Credit in the release notes for valid reports, if you want it.
security.txt
Contents for https://hellonexus.com/.well-known/security.txt:
Contact: mailto:[email protected]
Contact: https://hellonexus.com/security
Expires: 2027-07-11T00:00:00.000Z
Preferred-Languages: en
Canonical: https://hellonexus.com/.well-known/security.txt
Policy: https://hellonexus.com/security