Security
How NexusForge protects tenant data today: written as engineering reality, not a compliance brochure. We claim no certifications we do not hold.
What Is Implemented
- Invite-only Access. Private beta is not open signup. Membership is server-resolved from invites and sessions.
- Workspace Isolation Walls. Postgres Row Level Security (RLS) and membership checks are designed so one workspace cannot read another’s rows when the multi-tenant path is live.
- Session Cookies. App sessions use HttpOnly cookies; provider tokens are exchanged server-side for a NexusForge session rather than stored as ambient local secrets in the portal.
- Credential Vaulting. Marketplace connection secrets live in a vaulted envelope pattern, not in browser storage or public pages.
- Abuse Controls. Auth and invite-redeem paths carry rate limits and lockout; CSRF/origin checks apply to every cookie-authenticated state change.
- Secret Classification. Workspace settings classify secret keys so they are not casually echoed into logs or UI.
What We Do Not Claim
NexusForge does not claim SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, or any other third-party certification on this page. When an audit lands, we will publish the exact scope, not before.
Reporting a Concern
Suspected security issues should go through Report a security concern with enough detail to reproduce. Do not include live credentials in the message.