Security Overview

Nexus is built for enterprises, critical infrastructure, and government programs where security, audit integrity, and regulatory compliance are hard requirements. This section documents the security model, controls, and processes that make Nexus suitable for regulated and classified environments.

Nexus enforces security at multiple layers:

• Tamper-evident audit — Every request generates a cryptographically sealed audit record with Merkle-chain inclusion proofs, ed25519-signed batch roots, and WORM archival
• Policy enforcement — A dedicated policy decision point evaluates every request before it reaches a provider, with machine-enforced obligations that fail closed
• Classification enforcement — Label-based data handling with scope ceilings and gateway-enforced redaction for regulated or classified data
• Multi-tenant isolation — Tenant credentials are encrypted at rest; scope checks prevent cross-tenant data leakage
• Service authentication — Internal RPCs require bearer service tokens with per-RPC scope validation
• Provenance and verification — Released images are signed with cosign, with SBOM and provenance attestations anchored in Rekor

• Security engineers evaluating Nexus for deployment in regulated environments
• Compliance officers mapping Nexus controls to NIST SP 800-53, SOC 2, or GDPR requirements
• Security researchers reviewing the threat model or reporting vulnerabilities
• Auditors verifying tamper-evident audit claims
• Operators configuring classification labels, policy rules, or production secrets

Do not open public issues for suspected security vulnerabilities.

Report vulnerabilities privately following the process in Security Policy. We commit to:

• Acknowledge reports within 48 hours
• Provide initial assessment within 5 business days
• Coordinate disclosure timelines with reporters
• Credit researchers in release notes (unless anonymity is requested)

Nexus follows coordinated disclosure practices and publishes security advisories for confirmed vulnerabilities.

Page	Description	Audience
Security Overview	Security architecture, threat model, and cryptographic posture	Security engineers, auditors
Security Policy	Vulnerability disclosure, security practices, and supported versions	Security researchers, operators
Compliance Map	NIST SP 800-53 control mappings with implementation evidence	Compliance officers, auditors
Audit Proof Format	Cryptographic audit verification format and procedures	Auditors, operators

• Compliance Map - NIST SP 800-53 control mappings
• Audit Proof Format - Cryptographic audit verification
• Data classification as a first-class request header - Classification enforcement
• Tamper-evident audit via per-tenant Merkle chains - Audit architecture
• FIPS build support behind a cargo feature - FIPS 140-3 compliance