Introduction
Nex Global LLC, trading as Nex Systems (Nex), takes the security of its services and of its customers' data seriously. No system is 100% secure, and we value the help of security researchers who find and report vulnerabilities responsibly.
This Responsible Disclosure Policy (the Policy) explains what systems are in scope, how to report a vulnerability, the rules researchers must follow, and what researchers can expect from us. By testing Nex systems or submitting a report, you agree to this Policy.
1. Scope
1.1 In scope.
- (a) the public website nex.systems and its subdomains operated by Nex; and
- (b) the Nex web application and public API, but only using an account you have registered yourself or a test account Nex has given you.
1.2 Out of scope.
- (a) any system, account or data belonging to a Nex customer, partner or other user;
- (b) third-party services that Nex uses, such as hosting, email or payment providers, which should be reported to those providers under their own programmes;
- (c) physical security, offices and Nex Personnel, including social engineering and phishing;
- (d) denial-of-service and load testing; and
- (e) findings with no realistic security impact, including missing best-practice headers without a working exploit, clickjacking on pages without sensitive actions, self-XSS, rate-limiting suggestions on non-sensitive endpoints, software version disclosure, SPF/DKIM/DMARC configuration notes, and reports produced only by automated scanners.
2. How to Report
2.1 Send your report to security@nex.systems. Please include:
- (a) a description of the vulnerability and its potential impact;
- (b) the affected URL, endpoint or component;
- (c) clear steps to reproduce, with any proof-of-concept code, requests and responses;
- (d) screenshots or a short video where helpful;
- (e) the date and time of testing and the IP addresses you used; and
- (f) your name or handle and how to contact you, if you want a reply.
2.2 Write in English, and do not include any personal data or Customer Data in your report beyond what is strictly necessary to show the issue. If you accidentally obtained such data, tell us in the report and do not keep a copy.
2.3 Do not send reports through social media, support tickets or other public channels.
3. Rules of Engagement
3.1 When researching, you must:
- (a) only test systems in scope, using your own accounts;
- (b) stop as soon as you have confirmed a vulnerability, and not go further to explore, pivot or escalate;
- (c) never access, download, change, delete or keep data that does not belong to you, including Customer Data, screening records and other users' information;
- (d) never degrade the services, including by denial-of-service, spamming, brute-forcing or high-volume automated testing;
- (e) never use social engineering, phishing or physical attacks against Nex Personnel, customers or offices;
- (f) never install malware, backdoors or persistent access, or run destructive tests;
- (g) never demand payment, or threaten to publish or misuse findings; and
- (h) comply with all applicable laws, including computer misuse and data protection laws.
3.2 Confidentiality. Keep the details of any vulnerability confidential until Nex has fixed it and agreed to disclosure, or until ninety (90) days after your report, whichever comes first, unless we agree otherwise in writing.
3.3 Sanctions. Nex cannot engage with or acknowledge reports from persons who are sanctioned or located in comprehensively sanctioned jurisdictions.
4. Good-Faith Safe Harbour
4.1 If you make a good-faith effort to comply with this Policy, Nex:
- (a) will consider your research to be authorised for the purposes of its own terms that prohibit testing, and will not bring a legal claim against you for that research; and
- (b) will not report you to law enforcement for that research.
4.2 Limits. This safe harbour:
- (a) applies only to Nex's own rights and systems, and cannot authorise testing of, or bind, any third party, including Nex's customers and hosting providers;
- (b) does not apply to conduct outside the rules in section 3, or to any access to or use of data that does not belong to you; and
- (c) does not prevent Nex from complying with its legal obligations, including any obligation to report a crime or a data breach.
4.3 If you are unsure whether a test is allowed, ask us first at security@nex.systems.
5. Our Commitments and Timelines
5.1 When you report in line with this Policy, Nex will aim to:
| Step | Target |
|---|---|
| Acknowledge your report | Within 2 business days |
| Give an initial assessment (valid, duplicate, out of scope) | Within 10 Business Days |
| Keep you updated on progress | At least every 30 days for valid reports |
| Fix the vulnerability | According to severity, as set out in Nex's internal remediation targets |
| Agree on disclosure | Before any public disclosure, normally within 90 days of your report |
5.2 Nex will treat your report confidentially and will not share your identity outside Nex without your consent, unless the law requires it.
5.3 Nex decides the severity and priority of each report, and whether a report is a duplicate. The first valid report of an issue is the one acknowledged.
6. Recognition, No Rewards, and Contact
6.1 No monetary rewards. Nex does not currently run a paid bug bounty programme and does not pay rewards, fees or compensation for reports. A request for payment as a condition of disclosing a vulnerability will not be accepted.
6.2 Recognition. With your permission, Nex may thank you publicly for a valid, previously unknown report that leads to a fix.
6.3 Changes. Nex may change or withdraw this Policy at any time by publishing a revised version at nex.systems/legal. The version in force when you submit a report applies to it.
6.4 Contact. security@nex.systems Security contact details are also published at www.nex.systems Nex Global LLC, trading as Nex Systems, Wyoming, United States.
Common questions
Short answers for orientation. The document above governs if anything differs.
The nex.systems website and subdomains operated by Nex, and the Nex web application and public API using only an account you registered yourself or a test account we gave you. Customer systems, third-party services, social engineering, physical security, denial-of-service testing and low-impact findings are out of scope (see Section 1).