Nexus402
SearchCtrl K

    ↑ ↓ to move, Enter to open, Esc to closeOpen the search page

    Sign in
    Sign in

    Legal

    Security

    How Nexus402 protects keys, money and tool calls, and how to report a vulnerability to us.

    Version 1.0, effective October 25, 2026.

    Keys

    Stored only as an argon2id hash with a secret pepper, shown once, and never forwarded to a creator.

    Keys, caps and rotation →

    Money

    Pre-funded wallets with no auto-top-up, and a price deducted in one atomic operation. If our infrastructure is down, calls are refused, never given away.

    When you are charged →

    Tool calls

    Nexus402 does not store or log the contents of tool calls. The gateway reads only the request envelope (method and tool name) to route and bill, and computes a one-way hash.

    Privacy Policy →

    Requests to creators

    Every forwarded request is signed with Ed25519, so a creator can reject anything that did not come from the gateway.

    Verifying a request →

    Found a vulnerability? Email security@nexus402.dev as the policy below describes. The contact is also published in security.txt. To report a tool, a key or content instead, use the report form.

    Frequently asked questions

    How do I report a vulnerability?

    Email security@nexus402.dev with the affected URL or endpoint and steps to reproduce, as described in the disclosure policy on this page. The same contact is published in /.well-known/security.txt.

    Will you take legal action against a researcher?

    Not if you act in good faith and follow the rules in the disclosure policy: we will not take legal action against you or ask law enforcement to, for testing within scope. Testing against third parties is not authorised.

    Do you store the contents of my tool calls?

    No. Nexus402 does not store or log the contents of tool calls. The gateway reads only the request envelope (method and tool name) to route and bill, and computes a one-way hash. See the Privacy Policy.

    How are API keys stored?

    Only as an argon2id hash with a secret pepper. The secret is shown once, when you create the key, and cannot be shown again.

    What should I do if a key is exposed?

    Revoke it in the account console and create a new one, then tell us at security@nexus402.dev. Rotation and revocation are covered in Keys, caps and rotation.

    What does a creator receive about me?

    Your key never reaches a creator: it is consumed at the gateway and stripped. We do not send your email address or account identifiers to creators.

    How can a creator check that a request came from Nexus402?

    Every forwarded request carries an Ed25519 X-Nexus-Signature. Verifying a request explains the check, and the reference endpoint implements it.

    Do you see my card number?

    No. Card payments are taken by Stripe Checkout, and we do not collect card numbers.