DocNimble Security and Responsible Disclosure
This page describes implemented safeguards and known boundaries. It is not a claim that any internet service is impossible to compromise.
Last reviewed:
Processing boundaries
Client tools process selected files in browser memory. Worker tools use authenticated job submission, isolated identifiers, signed callbacks, checksums, expiring downloads and scheduled cleanup. A worker capability is labelled live only after availability and acceptance evidence are recorded.
Application safeguards
State-changing forms use CSRF protection, database operations use prepared statements, session cookies are HttpOnly and SameSite, internal directories are denied over HTTP, private routes carry noindex headers, and production error pages suppress stack traces and SQL details.
Transport and browser headers
The package sets HTTPS canonicalisation, HSTS, content-type sniffing protection, referrer and permissions policies, frame restrictions and a Content Security Policy. Hosting configuration can override or omit headers, so production headers must be re-checked after deployment.
Support-system safeguards
Anonymous chat writes use an HMAC token bound to a random HttpOnly support cookie. Screenshot uploads accept only validated PNG/JPEG/WebP images within the configured limit, use randomized private filenames and are re-encoded when the host has GD available. Admin replies and settings require superadmin authentication plus CSRF protection. WhatsApp Cloud webhooks are disabled by default and fail closed unless the Meta app-secret signature validates; Cloud tokens, app secret and verify token are encrypted at rest.
Secrets
Database passwords, application keys, payment secrets and worker HMAC secrets belong in protected configuration and are not rendered back by the integration settings screen. Never send them through support messages or screenshots.
Dependencies
Browser engines are version pinned, served from this origin after installation and recorded with SHA-384 in the vendor manifest. The installer blocks completion when required local engines cannot be verified. See Privacy Proof for the processing boundary and offline-cache rules.
Responsible disclosure
If you believe you found a security issue, do not include confidential third-party files or exploit unrelated accounts. Use the contact form and identify the affected URL, expected behaviour and a minimal reproduction. The machine-readable disclosure contact is also published at /.well-known/security.txt.
Production verification
Host-level TLS, response headers, permissions, backup restore and live worker behaviour are external deployment checks. Admin Diagnostics should be reviewed after every release.