Please report security issues privately — do not open a public issue.
- Email: nexus.smarthome.app@gmail.com
- GitHub: private vulnerability report (visible only to the maintainers)
- Subject:
[SECURITY] NEXUS — <short summary>
Include: affected component (desktop, Android, site, Edge Functions, AI worker), steps to reproduce, and impact. We aim to respond within 72 hours and will credit reporters after a fix unless you prefer to stay anonymous.
nexus-smarthome.pages.dev(account, downloads and billing site)- NEXUS desktop (Windows/Linux) releases — https://github.com/Enard52/nexus-releases
- NEXUS Android APK (site download)
- Supabase Edge Functions (whop-webhook, daily-stats, weekly-backup, delete-account, client-error, household-invite)
- Cloudflare Worker
nexus-ai(app AI chat)
Out of scope: self-hosted Home Assistant instances, your local network devices, spam/social engineering, issues in dependencies already tracked upstream (report those upstream; we track via Dependabot).
Coordinated disclosure preferred; please allow up to 90 days before public disclosure.
| Asset | Where it lives | Protection | Known limits |
|---|---|---|---|
| Device credentials (Tuya local keys, Tapo password, MQTT login) | This device only (nexusLanSecrets); never synced to the cloud or included in backups |
Desktop app: encrypted with the OS keychain (Electron safeStorage); old plain records are migrated on first read |
Browser and keychain-less environments store them unencrypted in local storage; the UI says so. Android secure storage is not implemented yet. |
| Account data (Supabase) | Supabase with row-level security | Per-user policies; only publishable keys ship in the app | Depends on correct RLS; report issues via the policy above |
| LAN control traffic | Local network | Desktop bridge only talks to private addresses | Many LAN protocols are plain by design (device firmware); a hostile local network can observe them |
| Error reports | Optional, opt-in toggle in Settings | Only page, version, platform and message; local log can be viewed and cleared | None known |
| Release binaries | GitHub Releases | Published from CI; checksums provided | Windows builds are not yet signed with a paid certificate |