Responsible Vulnerability Disclosure
TL;DR
🛡️ We welcome good-faith security research. Report via security@nexcyber.eu (PGP key below). Safe harbor for in-scope,
in-policy research.
📥 How to report
- ✉️ Email: security@nexcyber.eu
- 🔑 PGP fingerprint: published at https://nexcyber.eu/.well-known/security.txt (RFC 9116)
- 📋 Include: affected component, vulnerability type, reproduction steps, impact, your contact
✅ In scope
- nexcyber.eu (the live app)
- api.nexcyber.eu (backend API)
- support.nexcyber.eu, docs.nexcyber.eu (support stack)
🚫 Out of scope
- nexcyber.eu (parking page — not the live app)
- DoS / volumetric attacks
- Social engineering of our team
- Vulnerabilities requiring physical access
⚖️ Safe harbor
Good-faith research, within scope, without data exfiltration → no legal action. Please don't test on production without
authorization.
⏱️ Our commitments
- 📩 Acknowledgment: within 24 hours
- 🔍 Triage: within 3 business days
- 🔁 Regular updates until resolution
- 🏆 Optional Hall of Fame credit
➡️ Next
- 🔐 How we protect your data
- 🌍 Sub-processors list
💬 Need help?
Reach out via our live chat (bottom-right) — Captain AI replies instantly, human experts within business hours. Email
support@nexcyber.eu with [P1] for Command/Strategic priority issues.
ℹ️ Disclaimer — NexCyber provides a readiness analysis, not legal advice. Final compliance may require legal review or
notified body certification.
Last reviewed: 2026-06-02 · NexCyber Help Center