This document is a draft. It is not legal advice and it is not in force. It becomes required only when the owner adopts it by a recorded decision in nexus-governance. Until then nothing here blocks anyone’s work.

Websites and services of the networks that publish Reports, and the nexus-reports-platform plugin. Out of scope: denial of service tests, social engineering of staff, physical attacks, spam, and third-party services we do not run (report those to the third party).

Email the contact form with subject "Security". Include the address of the site, what you found, steps to reproduce, and the impact you believe it has. Encrypt if you can; ask for a key in a first message if you need one. The file at /.well-known/security.txt lists the contact (see the security.txt document).

• Acknowledge within 3 days.
• Give a first assessment within 10 days.
• Keep you informed until fixed.
• Fix critical issues first and tell you when they are fixed.
• Credit you in the fix notice if you want it.
• We do not pursue legal action for good-faith research that follows this policy.

• Test only your own accounts or accounts we have given you.
• Do not read, change, delete or copy data that is not yours. Stop if you see personal data and tell us.
• Do not degrade the service.
• Give us reasonable time to fix before you publish. We propose 90 days.
• Do not demand payment. We run no bounty programme.

If a report concerns personal data, the Privacy Officer assesses it under PIPEDA breach rules, Quebec Law 25 and, where it applies, GDPR. Affected people and regulators are told where required.

Errors in published content follow the incident response for publication errors, not this policy.

This policy is reviewed once a year. Counsel confirms the legal safe harbour wording before adoption.