Nod / security
Security is part of the product boundary.
This page explains the current preview's security posture and how to report a suspected vulnerability. It records what is true today; it does not claim a certification, audit, or guaranteed response time.
Current posture
The public website is a mostly static site with no account system, advertising trackers, analytics scripts, or browser storage for scan results. Its pages use content-security policies and security headers. The public scanner is currently launch-gated on the production site. The local/API implementation is designed to accept public repositories only, bound downloads to size limits, extract supported text files, avoid following archive symlinks or path traversal, rate-limit requests, and delete temporary scan workspaces after a response.
What not to send
Never submit passwords, API keys, access tokens, private repository URLs, production database exports, or unnecessary personal data. The scanner is for source-code review, not production data processing. If a repository contains secrets, remove and rotate them through the relevant provider before sharing or scanning it.
Responsible disclosure
If you find a security issue in Nod, email [email protected] with “Security report” in the subject. Include the affected URL or component, a short description, reproducible steps, impact, and a safe proof of concept if needed. Redact credentials and personal data. Please do not destroy data, access other people's accounts, spam the service, or publish an unremediated issue before giving us a reasonable chance to investigate.
Scope
For this notice, the intended scope is the public Nod website and the Nod scanner code published at github.com/NISTALTALSON/nod-scan. Do not test GitHub, Netlify, Cloudflare, email providers, or other third-party infrastructure through Nod; report issues in those services to their own security teams.
What we do not claim
Nod does not currently claim SOC 2, ISO 27001, a bug-bounty program, a formal SLA, penetration-test coverage, or a dedicated security operations team. Those claims should only be added after the relevant controls and evidence exist.
Contact
For security questions that are not vulnerability reports, use [email protected]. For information about the scanner's current information handling, read the privacy note.