Responsible disclosure policy

How to report

1. E-mail security@nexovia.co.in with the subject "Security report".
2. Describe the issue, the address or component affected, the steps to reproduce it and what an attacker could achieve.
3. Include proof of concept output or screenshots, but no real customer data. If you saw customer data by accident, tell us and delete it.
4. Give us time to fix it before you tell anyone else. We aim to fix critical issues within 7 days, high within 30 days and medium within 90 days.

Our machine-readable contact details are published at /.well-known/security.txt, following RFC 9116.

In scope

• nexovia.co.in and its sub-pages
• The Nexovia Console, Nexovia ID sign-in pages and the developer API
• Isolation between customers: anything that lets one customer's app reach another customer's data, code or secrets
• Blinke Host services that run on Nexovia (blinkehost.com, Blinke Mail, Blinke Send)

Out of scope

• Apps that our customers build and host on Nexovia: report those to the app's owner
• Denial-of-service attacks, load testing, spam and social engineering of our staff
• Physical attacks on data centres
• Reports from automated scanners without a demonstrated impact, missing best-practice headers on pages without sensitive data, and self-XSS

Rules for testing

• Use only accounts you own or have permission to use. Our 14-day free trial gives you a test account.
• Do not access, change or delete data that is not yours, and stop as soon as you confirm an issue.
• Do not degrade the service for other customers.
• Keep the details confidential until we confirm the fix.

What we promise

• An acknowledgement within three working days and a first assessment within ten.
• Updates as we investigate and when the fix is released.
• No legal action against research done in good faith under this policy.
• Credit on our Trust Centre if you want it, once the issue is fixed.

We do not run a paid bug bounty today. Exceptional reports may receive a thank-you of our choosing.

Questions