Security Policy
Vulnerability disclosure, security practices, and supported versions — for security researchers and operators.
Read the policy →Security Overview
Security architecture and practices for Nexus
Nexus is built for enterprises, critical infrastructure, and government programs where security, audit integrity, and regulatory compliance are hard requirements. This section documents the security model, controls, and processes that make Nexus suitable for regulated and classified environments.
Security-First Design
Section titled “Security-First Design”Nexus enforces security at multiple layers:
- Tamper-evident audit — Every request generates a cryptographically sealed audit record with Merkle-chain inclusion proofs, ed25519-signed batch roots, and WORM archival
- Policy enforcement — A dedicated policy decision point evaluates every request before it reaches a provider, with machine-enforced obligations that fail closed
- Classification enforcement — Label-based data handling with scope ceilings and gateway-enforced redaction for regulated or classified data
- Multi-tenant isolation — Tenant credentials are encrypted at rest; scope checks prevent cross-tenant data leakage
- Service authentication — Internal RPCs require bearer service tokens with per-RPC scope validation
- Provenance and verification — Released images are signed with cosign, with SBOM and provenance attestations anchored in Rekor
Who Should Read This Section?
Section titled “Who Should Read This Section?”- Security engineers evaluating Nexus for deployment in regulated environments
- Compliance officers mapping Nexus controls to NIST SP 800-53, SOC 2, or GDPR requirements
- Security researchers reviewing the threat model or reporting vulnerabilities
- Auditors verifying tamper-evident audit claims
- Operators configuring classification labels, policy rules, or production secrets
Reporting Security Vulnerabilities
Section titled “Reporting Security Vulnerabilities”Do not open public issues for suspected security vulnerabilities.
Report vulnerabilities privately following the process in Security Policy. We commit to:
- Acknowledge reports within 48 hours
- Provide initial assessment within 5 business days
- Coordinate disclosure timelines with reporters
- Credit researchers in release notes (unless anonymity is requested)
Nexus follows coordinated disclosure practices and publishes security advisories for confirmed vulnerabilities.
In This Section
Section titled “In This Section”Threat Model
STRIDE-style threat list scoped to current repository behavior, with residual risks — for security engineers and auditors.
Review threats →Compliance Map
NIST SP 800-53 control mappings with implementation evidence — for compliance officers and auditors.
Map controls →Audit Proof Format
Cryptographic audit verification format and procedures — for auditors and operators.
Verify audits →More Information
Section titled “More Information”Classification Enforcement
Data classification as a first-class request header, with scope ceilings and gateway-enforced redaction.
Read ADR 0008 →Audit Architecture
Tamper-evident audit via per-tenant Merkle chains, signed batch roots, and WORM archival.
Read ADR 0007 →FIPS 140-3 Compliance
FIPS build support behind a cargo feature for deployments that require validated cryptography.
Read ADR 0021 →