Security

Reporting a vulnerability

Email aqadirkhan93@gmail.com with “security” in the subject. Include what you found, where, and enough detail to reproduce it. You will get an acknowledgement, and I will tell you what the fix looks like and when it lands.

Please report privately first and give a reasonable window before publishing. There is no bug bounty — Novaryn is one person, and pretending otherwise would waste your time. Credit is offered gladly if you want it.

Please do not run automated scanners against the products, attempt denial of service, or access data that is not yours. If a proof of concept needs real data, stop and describe it instead.

Reporting scope

This site, the console, and the products Novaryn runs itself. Third-party infrastructure — the hosting providers, Anthropic, payment processors — should go to those vendors, though I would still like to know.

What this site does

• No accounts, no passwords, no payment details, and no personal data stored server-side. The smallest attack surface is the one that does not exist.
• Security headers on every response: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a Permissions-Policy denying camera, microphone and geolocation.
• The assistant endpoint is rate limited per client, bounds question and history length, and returns a bounded response. Model output is rendered as text nodes and <strong> only — never as HTML — so a model response cannot inject markup.
• Outbound links carry rel="noopener noreferrer", closing the tab-napping vector that target="_blank" opens by default.

Decisions already made in the platform

These are architectural commitments in the shared platform, some shipped and some specified. They are listed because the design is public and can be argued with.

• The theme engine treats operator input as untrusted. A theme is operator-controlled data that ends up inside a <style> tag. Numbers are bounded by schema and re-serialised rather than interpolated; font stacks are split and validated per family with hostile entries dropped whole, so a tenant admin who may change the brand font cannot restyle the billing page or hide a consent notice. Covered by tests.
• The organisation is the tenancy boundary, not the user (planned). Every product-owned row carries an org id, enforced by Postgres row-level security and a mandatory actor context that throws on an unscoped query — because RLS alone does not protect paths that legitimately run as a service role.
• No product will hold a model provider key (planned). All model access goes through a gateway that owns keys, budgets and rate limits.
• Tool arguments get re-authorised server-side after the model produces them (planned), and tool schemas never accept a user id — the actor comes from the session. A model that can name a user id can be talked into naming someone else's.
• Retrieved content is data, never instruction (planned). A document under review is exactly the kind of thing an attacker controls.
• File access is signed URLs only (planned), and the audit log is append-only.

What Novaryn does not claim

No SOC 2, no ISO 27001, no penetration test report, and no formal security programme. Novaryn is early and small. If you need those to proceed, say so and I will tell you honestly where things stand rather than sell you a certification that does not exist.