Vulnerability disclosure. Report it to us, in good faith.

How to report

Write to security@nyquist.pro in English or Russian. Tell us the address or endpoint, the steps to reproduce it, what an attacker gains, and any proof of concept you built. A short, reproducible report is easier to act on than a long one.

Nyquist is a small founding team with no dedicated security staff. The founders read reports and answer from the address you wrote to. This policy sets no response or fix deadlines. The machine-readable form of this contact is security.txt.

In scope

• api.nyquist.pro — the backend and all /api/* endpoints.
• nyquist.pro and the other *.nyquist.pro hosts — the web application, the public demo, the Telegram Mini-App, and the research and survey sites.
• getnyquist.com — this website.

Services run by others are not ours to authorise. This covers our cloud and e-mail providers and the other third parties listed on the sub-processors page: report problems in their products to them.

Rules

• Test with your own account or the public demo. Do not access, change or delete data that is not yours.
• If you reach personal or customer data, stop at the smallest proof, do not copy or keep it, and tell us what you saw.
• No load tests and no denial-of-service. Do not degrade the service for other people.
• Keep the details private until the issue is fixed or we tell you it will not be. Agree a date with us before you publish.

Safe harbour

If you follow this policy in good faith, we will treat your research as authorised and will not take or support legal action against you for it. This applies to our own systems only. We cannot give permission on behalf of third parties, and it does not cover research that breaks the rules above.

Out of scope

Please do not report:

• Denial-of-service findings on public endpoints.
• Rate-limit bypass through request headers. We already limit by IP address.
• Missing SPF, DKIM or DMARC on non-production e-mail domains.
• Self-XSS, which needs the victim to paste hostile script themselves.
• CSV injection in exports that a user downloads.
• CSP report-uri or iframe-busting findings with no functional impact.
• Published CVEs in third-party dependencies without a working exploit against us. We scan dependencies in CI with pip-audit and pnpm audit; duplicates will be closed.

What we do not offer

There is no bug bounty: we do not pay for reports. There is no public hall of fame at the moment. We do not claim a security certification or an external penetration test; what is and is not in place is described on the security page.