Security

Controller of personal data

[PLACEHOLDER: controller of personal data, a legal entity named by the owner]

Grievance contact

[PLACEHOLDER: grievance officer name and contact, supplied by the owner or counsel]

Data residency

[PLACEHOLDER: data residency statement, written by the owner or counsel]

Effective date: [PLACEHOLDER: effective date of this page].

Report a vulnerability

Email security@nixtra.tech ([PLACEHOLDER: a real, monitored security mailbox]). Include what you found, the page or file, the steps to repeat it, and what you think the impact is. Please do not post it in public before we have had a chance to fix it. We aim to reply within [PLACEHOLDER: N days to acknowledge a vulnerability report]. This is a target, not a promise.

The same details are in the machine-readable file /.well-known/security.txt. To report a pack that breaks the content policy, use the report page instead.

In scope

• The site at nixtra.tech: its pages, scripts and static files.
• The genome builder and the catalog search that run in your browser.
• The build scripts and the scan rules in the public repository, if it is public.
• A genome pack that carries a hidden instruction or a secret and got past the scan rules. Report that one on the report page.

Out of scope

• The hosting provider’s own systems ([PLACEHOLDER: host name]). Report those to the provider.
• IntelliNix, which is a separate product with its own process.
• Denial of service, spam, social engineering and physical attacks.
• Reports that only say a header or setting is missing, with no way it can be used against a visitor.

Safe harbour

[DRAFT: safe harbour wording, for a lawyer to write]. The intent is that we will not take action against someone who looks for problems in good faith, stays within the scope above, does not read or change other people’s data, does not degrade the site, and reports what they find to us. A lawyer must write and check the final wording. Until then this paragraph does not bind [LEGAL ENTITY NAME] and gives no legal protection.

What the site does today

• Static hosting. The site is a set of files. It has no application server, no database and no login to attack.
• Strict headers. The launch setup is meant to send strict response headers (such as a content security policy) from the host. That belongs to the launch work, so check the live site before relying on this line.
• No third-party scripts. Pages load no outside scripts, fonts or widgets.
• Build-time catalog scans. Every pack is run through fixed scan rules for secrets, personal data, injection phrases and more before it is listed. See the content policy for what the rules catch and what they miss.

None of this means the site cannot have flaws. It lists what is in place today. It is not a certification or an audit.

Open placeholders on this page

• [PLACEHOLDER: effective date of this page]
• [PLACEHOLDER: a real, monitored security mailbox]
• [PLACEHOLDER: N days to acknowledge a vulnerability report]
• [DRAFT: safe harbour wording, for a lawyer to write]
• [PLACEHOLDER: host name]
• [LEGAL ENTITY NAME]
• [PLACEHOLDER: controller of personal data, a legal entity named by the owner]
• [PLACEHOLDER: grievance officer name and contact, supplied by the owner or counsel]
• [PLACEHOLDER: data residency statement, written by the owner or counsel]