Security
Reporting a vulnerability.
Found a security problem in NEXO Edge or NEXO Hub? Write to security@nexohub.xyz. No account, no support contract, no prior relationship needed.
What helps us fix it faster.
Which version
The product and version affected — for Edge, the version shown in Settings.
What it allows
What an attacker can do, and what access they need to start.
How to see it
Steps to reproduce, even rough ones. A screenshot often beats a paragraph.
Please give us a reasonable window to fix the issue before disclosing publicly. We will tell you what we found, what changed and when it ships. We do not run a bug bounty and will not pretend otherwise.
Supply chain
How updates are protected.
Every NEXO Edge release is signed with a key kept offline, never present on the servers that distribute it.
Signature first
The release description is verified before it is parsed — not after.
Hash pinned
The downloaded installer is re-hashed against the value pinned inside the signed description.
Checked again
And re-checked immediately before the installer is launched, not just at download.
Published openly
The same hash is on the download page, so you can verify a file without trusting the server or us.
The practical consequence: whoever controls the download server can withhold an update, but cannot forge one.