Responsible disclosure

If you find a security vulnerability in Nexoviaai, please tell us at security@nexoviaai.com. Include the affected URL or endpoint, steps to reproduce, and the impact you saw.

What we commit to

• Acknowledge your report within 2 business days.
• Give you an initial assessment within 5 business days, and keep you updated until it is fixed.
• Not take legal action against good-faith research that follows this policy.
• Credit you publicly once it is fixed, if you would like.

Please do not

• Access, change or delete data that is not yours, or keep any data you come across.
• Run denial-of-service tests, spam, social engineering or physical attacks.
• Test against other customers' accounts or keys.
• Run up model usage costs on accounts you do not own.
• Disclose the issue publicly before we have fixed it or 90 days have passed, whichever comes first.

Out of scope

Model outputs themselves (report these to the model provider), missing security headers with no demonstrated exploit, and issues in third-party services we do not control.

We do not currently run a paid bug bounty. Our security contact is also published at /.well-known/security.txt.