Security Policy — Nucore Systems LLC

Contact

How to Report a Vulnerability

Please report any suspected security vulnerabilities responsibly and privately before disclosing them publicly. We ask that you give us reasonable time to investigate and address the issue.

🔒

[email protected]

Send all vulnerability reports to this address. We aim to respond within 5 business days.

📧

Email Report

Send a detailed email to [email protected] describing the vulnerability, including steps to reproduce, impact assessment, and any proof-of-concept if available.

🔐

Encrypted Communication

For sensitive disclosures, we encourage you to encrypt your email. Please contact us first at [email protected] to request our PGP key.

Scope

What's In Scope

We welcome reports on security issues affecting any of our core systems and properties.

✅ In Scope

nucoresys.com and all subdomains
Nucore web application and dashboard
Authentication and session management
API endpoints and data handling
User data exposure or leakage
Cross-site scripting (XSS)
SQL injection or data injection
Broken access control / privilege escalation
Security misconfigurations

🚫 Out of Scope

Denial of service (DoS/DDoS) attacks
Physical security issues
Social engineering or phishing of Nucore staff
Spam or email flooding
Vulnerabilities in third-party services we use
Issues on non-Nucore infrastructure
Automated scanner results without proof of impact
Missing security headers without demonstrated impact

Process

Our Response Process

Here's what happens after you submit a vulnerability report.

Step 1

📬

Acknowledgement

We confirm receipt of your report within 5 business days and assign it a tracking reference.

Step 2

🔍

Investigation

Our team triages and investigates the report. We may follow up with questions to better understand the issue.

Step 3

🛠️

Remediation

We develop and deploy a fix. For critical vulnerabilities, we prioritize an expedited patch.

Step 4

✅

Disclosure

We coordinate with you on responsible public disclosure timing once the fix is live.

Guidelines

Responsible Disclosure Guidelines

We ask that all security researchers follow these guidelines when investigating and reporting vulnerabilities.

Do not access, modify, or delete user data beyond what is necessary to demonstrate the vulnerability.
Do not perform DoS attacks or disrupt service availability during your research.
Do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it (typically 90 days).
Do not use automated scanners aggressively against our production systems.
Provide sufficient detail in your report to allow us to reproduce and understand the issue.
Act in good faith — we commit to doing the same in return.

🛡️ Safe Harbor

Nucore Systems LLC will not pursue legal action against security researchers who discover and report vulnerabilities in good faith and in compliance with these guidelines. We consider responsible security research a valuable contribution to the security of our platform and our users. If you follow these guidelines, we consider your research authorized and will work with you to understand and remediate the issue quickly.

Reporting

What to Include in Your Report

A detailed, well-structured report helps us triage and resolve issues faster.

📋

Required Information

Type and nature of vulnerability
URL or component affected
Step-by-step reproduction instructions
Potential impact and severity
Your contact information for follow-up

➕

Helpful Additions

Screenshots or screen recordings
Proof-of-concept code (non-destructive)
Browser and OS details
Network captures (if applicable)
Suggested remediation steps

Get in Touch

Ready to Report an Issue?

Thank you for helping keep Nucore Systems and our users safe. Responsible disclosure makes the entire platform more secure for everyone.

📧 Email [email protected] Contact Us

Our security.txt is available at https://www.nucoresys.com/.well-known/security.txt

Security Policy & Responsible Disclosure