Novabit Informationssysteme GmbH takes reports of vulnerabilities in Nuclos seriously. Please tell us in confidence first. Publish the finding only after we have coordinated it with you.
Scope
Please report issues in:
- the Nuclos source code at bitbucket.org/nuclos/nuclos, including the server, web client, installer, Nuclosian, and Nuclos MCP where those are part of the product
- services Novabit operates: nuclos.de, wiki.nuclos.de, support.nuclos.de, maven.nuclos.de, and api.nuclos.de
- Novabit Cloud, where Novabit operates the instance
Outside this path:
- Systems a customer operates itself. Report those to the operator. If the issue is in the Nuclos core, tell us as well.
- Social engineering, phishing against employees, or physical access.
- Load tests and availability attacks against production systems.
- Misconfigurations that affect only one instance and do not come from the product.
How to report
Email info@nuclos.de. Subject: Security report Nuclos.
Please do not open a public ticket on support.nuclos.de, a wiki page, or a public issue in the repository.
Useful details:
- description and impact
- affected version or commit
- steps we can use to reproduce the finding
- a minimal proof, if you have one
- how we can reach you
What happens next
- We acknowledge receipt within three business days.
- We keep the report confidential until a fix is available.
- We ask you to wait 90 days before publishing, or until we agree an earlier date.
- If you wish, we will name you after the fix is published.
- There is no bug bounty program at this time.
Good faith
If you report the finding to us in confidence first, access only what is needed to demonstrate it, do not copy, change, or delete customer data, do not disrupt production customer systems, and do not publish before coordination, we will not take legal action against you.
Report abuse
This path is for Nuclosian, not for vulnerabilities in Nuclos. Report vulnerabilities as described above.
Please report without delay:
- breaches of the Nuclosian acceptable use rules
- abused or leaked credentials
- unlawful content created or distributed through Nuclosian
Email betrieb-nuclosian@nuclos.de. Subject: Missbrauch Nuclosian.
Useful details:
- when it happened
- the affected instance or address
- what you observed
- a contact for follow-up
We treat the report as confidential. Novabit reviews it and may suspend access. Where the law requires it, we pass the report to the authorities.
Versions
We maintain the current Nuclos release line. We also fix severe issues in older lines still in use, where that is technically possible. Please update to the version that contains the fix.
Contact
Novabit Informationssysteme GmbH, Mühlweg 2, 82054 Sauerlach, Germany
info@nuclos.de · +49 (0) 8104 6473-0
Machine-readable: /.well-known/security.txt
As of 23 October 2026