Security
Security practices.
How Nevyrix Labs products handle data, and how to report a problem if you find one.
Responsible disclosure
Found a vulnerability in a Nevyrix Labs product? Send a clear description and steps to reproduce. Reports are acknowledged within 72 hours.
Android products
Built with zero network permissions wherever the feature set allows. Sensitive data is encrypted using Android Keystore-backed AES-GCM. No crash reporters, no analytics SDKs, and no telemetry of any kind by default.
Web products
All web properties set strict security headers including CSP, X-Frame-Options, and HSTS. Server actions are validated with Zod at the boundary, and the contact endpoint is rate limited. Static content is prerendered, so most routes execute no server code at all.