Responsible disclosure

If you have found a security vulnerability in this website or in a Nexxovate product, we would rather hear about it from you than from someone else. We will not pursue legal action against anyone who reports a genuine issue in good faith and follows the guidance below.

How to report

• Contact us with a description of the issue and how to reproduce it.
• Include the affected URL or product, and the impact you believe it has.
• Give us reasonable time to investigate and fix the issue before making it public.

Please do not

• Access, modify or delete data that is not your own.
• Run automated scanning that degrades service for other users, or test denial-of-service.
• Use social engineering, phishing or physical attacks against staff.

What to expect

We will acknowledge your report, keep you informed while we investigate, and tell you when it is resolved. We do not currently operate a paid bounty programme.

In scope

• This website, nexxovate.com, and its subdomains.
• The Nexyra products, including the website auditor at audit.nexxovate.com.

Where to send it

Email info@nexxovate.com with Security in the subject line, or use the contact form and mark your message the same way. A machine-readable version of this policy is published at /.well-known/security.txt, so security tools can find the right contact automatically.