Security and responsible disclosure

Send the report through the contact form and mark it as a security disclosure. Include the affected component or URL, the conditions needed to reproduce the issue, and what you were able to observe.

Test only against systems you are authorized to test. Do not access, modify or retain data that is not yours, do not run denial-of-service testing, and give us a reasonable period to investigate before publishing.

We acknowledge reports, assess the issue, and keep the reporter informed while a fix is prepared. Where a report affects deployed customers, affected organizations are notified through their normal support channel.

Nexus deployments run inside customer infrastructure. Issues specific to a customer environment should be raised with that organization, which operates the deployment.