Security

Reporting a vulnerability.

Found a security problem in NEXO Edge or NEXO Hub? Write to security@nexohub.xyz. No account, no support contract, no prior relationship needed.

What helps us fix it faster.

1

Which version

The product and version affected — for Edge, the version shown in Settings.

2

What it allows

What an attacker can do, and what access they need to start.

3

How to see it

Steps to reproduce, even rough ones. A screenshot often beats a paragraph.

Please give us a reasonable window to fix the issue before disclosing publicly. We will tell you what we found, what changed and when it ships. We do not run a bug bounty and will not pretend otherwise.

Supply chain

How updates are protected.

Every NEXO Edge release is signed with a key kept offline, never present on the servers that distribute it.

Signature first

The release description is verified before it is parsed — not after.

Hash pinned

The downloaded installer is re-hashed against the value pinned inside the signed description.

Checked again

And re-checked immediately before the installer is launched, not just at download.

Published openly

The same hash is on the download page, so you can verify a file without trusting the server or us.

The practical consequence: whoever controls the download server can withhold an update, but cannot forge one.