Vulnerability disclosure

Primary security contact

Jon Morehouse, Founder & CEO, is Nuon's primary security contact. Please report security issues to security@nuon.co. Include as much detail as you can; more context makes triage and remediation faster.

Open source

Nuon is open source. Researchers are welcome to review our public code and related security policy in the nuonco/nuon repository on GitHub.

Why Nuon's security matters

If an attacker could fully compromise a Nuon installation, they could spin up expensive resources, steal credentials, or access proprietary source code. We take this risk seriously and use routine pen testing, vulnerability scanning, and code reviews. We also welcome community contributions that help keep the product secure.

Bug bounty and reporting

We run a vulnerability disclosure program for good-faith security research. Report issues through the contacts above. We review valid reports and work with researchers under the commitments and expectations on this page. Recognition and any bounty decisions are at Nuon's discretion based on severity and impact.

Out of scope

Our primary concern is abuse of the Nuon application that lets an attacker access another user's workspace or spin up unwanted workspaces. The following are generally out of scope:

• DoS / DDoS affecting availability. We support rate limiting, but availability attacks are primarily left to the owner of the Nuon installation. A DoS that only affects availability is not a high-value target for this program.
• Abuse of a compromised user credential. If a credential is compromised outside the Nuon ecosystem, that is beyond the scope of our application. Escalation from an unprivileged user, or access to another workspace without authorization, is in scope.
• Vulnerabilities in third-party systems. Report those to the appropriate vendor or authority.

Our commitments

When you work with us under this policy, you can expect us to:

• Respond to your report promptly, and work with you to understand and validate it;
• Strive to keep you informed about the progress of a vulnerability as it is processed;
• Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
• Extend Safe Harbor for vulnerability research related to this policy.

Our expectations

In participating in our vulnerability disclosure program in good faith, we ask that you:

• Play by the rules, including this policy and any other relevant agreements. If there is any inconsistency between this policy and other applicable terms, this policy prevails for security research under it;
• Report any vulnerability you have discovered promptly;
• Avoid violating the privacy of others, disrupting our systems, destroying data, or harming user experience;
• Use only the official channels on this page to discuss vulnerability information with us;
• Provide a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
• Perform testing only on in-scope systems, and respect systems and activities that are out of scope;
• If a vulnerability provides unintended access to data: limit the amount of data you access to the minimum required for an effective proof of concept, and cease testing and submit a report immediately if you encounter user data such as PII, PHI, credit card data, or proprietary information;
• Interact only with test accounts you own or with explicit permission from the account holder; and
• Do not engage in extortion.

Safe Harbor

We extend Safe Harbor for good-faith research under this program. Full commitments and expectations are in our open-source SECURITY.md.

Product security

For how Nuon designs BYOC security (outbound-only runners, least privilege, customer-controlled access), see the Security docs.