Reporting a security problem

If you think you've found a security problem in NexoPages, please tell us at security@nexopages.com. We'll confirm we got your report within three business days and keep you updated until it's fixed.

What to include

• What you found and where (the page or API address).
• Steps to reproduce it, and what an attacker could do with it.
• How we can reach you, and whether you'd like to be credited.

In scope

• nexopages.com, the NexoPages app, api.nexopages.com, and pages hosted on NexoPages.

Please don't

• Access, change or delete other people's data. Use test accounts you create, and stop as soon as you've shown the problem.
• Run denial-of-service tests, spam, or automated scans that degrade the service.
• Use social engineering or phishing, or test our offices or staff.
• Test the admin console, or third-party services we use (report those to their owners).
• Share the problem with others until we've fixed it.

Our promise

If you act in good faith and follow this policy, we won't take legal action against you for your research, and we'll work with you to understand and fix the problem. We don't currently pay rewards, but we're glad to thank you publicly if you'd like.

How we protect NexoPages

• Each business's data is kept apart in the database itself, not only in our code.
• Encryption in transit everywhere, and encrypted storage for connection tokens.
• Passkey-only sign-in for our staff tools, with every action recorded in a tamper-evident log.
• Uploads are checked, resized and stripped of location data before anyone sees them.
• Daily backups with point-in-time recovery, and restore drills.

NexoPages is a product of Arkenly LLC.