Nexment takes the security of its software, infrastructure, and community seriously.
We appreciate the work of security researchers and community members who help us identify vulnerabilities and improve the security of Nexment products.
We encourage responsible security research that protects users, respects privacy, and avoids unnecessary disruption.
Email: admin@nexment.org
If you discover a potential security vulnerability in a Nexment project, product, or service, report it directly to the security contact above.
Do not disclose suspected vulnerabilities publicly before coordinating with the relevant maintainers.
Your report should include, where possible:
- Affected product: The project, service, repository, or component involved.
- Description: A clear explanation of the suspected vulnerability.
- Impact: What an attacker might be able to do.
- Reproduction steps: Sufficient information to help us understand and verify the issue.
- Supporting evidence: Relevant logs, screenshots, or proof-of-concept material, provided safely.
- Suggested mitigation: Any potential fix or mitigation you have identified.
Please do not include real users' passwords, access tokens, private information, or other sensitive data in your report.
You do not need to provide every item above to submit a valid report. Report what you know.
We ask security researchers to:
- Make good-faith efforts to avoid accessing, modifying, or exposing other people's data.
- Avoid disrupting services or degrading their availability.
- Avoid social engineering, phishing, or attacks against other people.
- Avoid destructive testing, persistence, and unnecessary privilege escalation.
- Stop testing and report the issue when sufficient evidence has been obtained.
- Keep vulnerability details confidential while a reasonable remediation process is underway.
- Follow applicable laws and respect the terms governing the affected systems.
Do not test systems, accounts, or infrastructure that you do not own or have explicit authorization to assess.
After receiving a report, Nexment aims to follow this process:
- Acknowledgment: Confirm receipt of the report.
- Assessment: Evaluate the reported issue, its severity, and its potential impact.
- Investigation: Reproduce and investigate the vulnerability where practical.
- Remediation: Develop and deploy an appropriate fix or mitigation.
- Disclosure: Coordinate with the reporter on responsible public disclosure when appropriate.
Response and remediation times depend on the vulnerability's severity, complexity, and affected systems.
We aim to acknowledge reports within seven calendar days and provide updates as reasonably possible.
Please understand that acknowledgment does not guarantee that a report will be accepted as a vulnerability or that a fix can be delivered within a particular timeframe.
This policy applies to security vulnerabilities in software, services, and infrastructure operated by Nexment, subject to the authorization and scope of the affected system.
For third-party services, dependencies, or independently operated infrastructure, please report the issue to the responsible provider when appropriate.
If you are unsure whether a system is in scope, contact us before performing security testing.
Please allow Nexment a reasonable opportunity to investigate and address a reported vulnerability before publishing technical details.
We will work with researchers in good faith to coordinate disclosure, especially when a vulnerability affects users or requires a longer remediation period.
If a vulnerability is actively being exploited or presents an immediate risk, we may need to take urgent protective action.
We appreciate responsible security research and may publicly acknowledge researchers who help improve Nexment's security, with their permission.
Unless a separate written program explicitly states otherwise, Nexment does not promise monetary rewards, bug bounties, or other compensation for vulnerability reports.
For security reports and questions about this policy, contact:
Nexment Security
Please use this address for security concerns rather than opening a public GitHub issue.
Security is a shared responsibility. Thank you for helping us build safer software.
Nexment — Build. Learn. Connect. Grow.