Security
Nova3 AI welcomes responsible disclosure of security issues. This page describes how to reach us, what is in scope, and the safe-harbor terms for good-faith research.
How to report a vulnerability
Email mj@nova3.ai with details. Include reproduction steps, observed impact, and any proof-of-concept material.
Expected response window
We acknowledge reports within five business days and give an initial response on confirmed issues within ten.
Coordinated disclosure
Report privately before disclosing publicly. We will confirm the issue, work on a fix, and let you know once it is resolved. We are open to crediting researchers by name once a confirmed issue is fixed, if you want the credit.
Please give us ninety days from the acknowledgement before publishing details, or less if we ship a fix sooner and confirm it with you. If a report affects data belonging to a client, we notify that client directly as part of the fix.
No paid bounty program
Nova3 AI does not currently run a paid bug bounty program. Reports are still welcome and still get a response under the window above.
Scope
- nova3.ai and its subdomains.
- The frontier monitor ingestion pipeline, the /mcp connector endpoint and its tools, and backend functions invoked from this site.
Out of scope: findings that only reproduce with automated scanner output and no working proof, volumetric denial of service, social engineering of our team or clients, physical access attempts, reports about missing headers or software versions with no demonstrated impact, and issues in third-party services we do not control. Client systems we build and operate are covered by their own agreements, so please do not test them. Send anything you find there to the same address and we will route it to the right owner.
Safe harbor
Good-faith security research conducted in accordance with this policy will not result in legal action by Nova3 AI. Researchers should avoid:
- Privacy violations and access to accounts that are not your own.
- Service disruption, including denial-of-service testing.
- Data destruction or exfiltration beyond what is required to demonstrate a vulnerability.