Security
Found a security problem in Nadeemi? Thank you. Please tell us first, so we can fix it before anyone is hurt.
How to report
Email security@nadeemi.com with:
- what you found and where (a link, a screen, an API path),
- the steps to see it again,
- what an attacker could do with it.
If you need to send something very sensitive, ask us first for a safer way. Our machine-readable contact file is at /.well-known/security.txt.
What we promise
- We reply within 3 working days and keep you updated until it is fixed.
- 90-day disclosure. Please give us 90 days from your report before you publish details. If we fix it sooner, we agree a date with you. If people are at risk right now, we may ask you to wait a little longer, and we will tell you why.
- No legal action against you for good-faith research that follows the rules below.
- Credit, if you want it: we will thank you by name on this page.
- We do not pay bug bounties yet. We will say so here if that changes.
Rules for testing
- Use only your own test accounts. Never read, change or delete other members' data. If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
- No denial-of-service, flooding, spam or tests that slow the service for others.
- No social engineering or phishing of our team or members, and no physical attacks.
- Do not try to break the encryption of other people's chats.
In scope: nadeemi.com, the app at nadeemi.com/app/, and our API (/v1/). Out of scope: reports that only come from automated scanners with no real impact, missing best-practice headers with no attack, and problems in other companies' services (tell them directly).
What protects members today
- HTTPS everywhere, strict content security rules, and rate limits.
- Private messages, group chats and Circles are encrypted on the device with MLS. We still label them "end-to-end encryption coming": no independent expert has reviewed our encryption yet.
- Email addresses and dates of birth are sealed on our servers; passwords are stored only as salted, peppered hashes.
- App updates are signed with a key kept off our servers and listed in a public log (Sigsum). The installed app checks them and reports the result; refusing unchecked updates will come after more testing.
- An internal security review of the code. An independent review is planned but has not happened yet.
Honest limits: Nadeemi is a beta. A web app loads its code from our server, so you have to trust that server. If your safety depends on it, do not rely on Nadeemi yet. Read what we can and can't see.
If something goes wrong
If we ever have a security incident that affects members, we post a notice on our status page and inside the app, tell affected members directly, and explain what happened and what we changed.