Security & Vulnerability Disclosure Policy
Last updated: October 19, 2026
1. Security architecture
NexaTools combines browser-local utilities with networked features. Many tools process files in browser memory, while networked features use backend APIs, Google Drive, third-party services, or WebRTC signaling. Certain features retain URLs, file metadata, encrypted blobs, commercial project inquiries, or bug reports. Our Privacy Policy details these data flows. While browser-local execution reduces server exposure, it does not eliminate device, browser, network, provider, or software risks.
2. Reporting a vulnerability
If you discover a security vulnerability in NexaTools, please report it privately to support@nexatools.in. Include a clear description, the affected URL or endpoint, potential impact, and minimal reproduction steps. Do not include other users' data, credentials, private files, or live encryption keys. Reports are reviewed and addressed as operational capacity permits.
3. Authorized scope and testing rules
Good-faith security research is limited to NexaTools-controlled public pages and APIs. Test only accounts, files, and data you own or have explicit permission to use. Do not access, modify, or retain another person's data. If you encounter sensitive information during testing, stop immediately and report only the minimum detail required to reproduce the issue.
- Do not conduct volumetric denial-of-service tests, automated vulnerability scanning at high request rates, credential stuffing, phishing, social engineering, or destructive testing.
- Do not test third-party infrastructure (including Google, Cloudflare, Microsoft, GitHub, Mail.tm, or Compiler Explorer) through NexaTools.
- Do not publicly disclose a vulnerability or proof-of-concept before coordinating a reasonable remediation window with us.
4. Out of scope
Reports concerning a user's own local browser storage, self-XSS requiring manual code execution by the user, missing HTTP headers without a demonstrable exploit, or vulnerabilities isolated to third-party services are generally out of scope.
5. Safe harbor
We consider good-faith security research conducted in compliance with this policy to be authorized conduct and will not initiate legal action against a researcher solely for compliant testing. This safe harbor applies only to NexaTools-controlled systems and does not authorize testing against third-party providers or waive non-excludable legal obligations.
6. Contact
Security disclosures and questions: support@nexatools.in.