We release patches for security vulnerabilities in the following versions:

We take security issues seriously. Please do not report security vulnerabilities via public GitHub issues.

Instead, report them privately by emailing the maintainer at hopcy.forcy@gmail.com.

You should receive a response within 48 hours. If for some reason you do not, please follow up to ensure we received your original message.

• Description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact
• Suggested fix (if any)
• Your contact information for follow-up

When we receive a security report, we will:

1. Confirm receipt within 48 hours.
2. Assess the issue and determine affected versions.
3. Develop and test a fix.
4. Release a security patch as soon as possible, coordinated with the disclosure date (typically 90 days after the report).

We believe in coordinated disclosure and will work with reporters to determine an appropriate timeline for public disclosure.

• Always use environment variables for secrets (database URLs, API keys).
• Set DEBUG=False in production (nexyconfig.py).
• Use HTTPS in production (configure via nexyconfig.py or a reverse proxy).
• Keep your Nexy version up to date.

For non-security bugs, please open a GitHub issue.

Static analysis with Bandit over nexy/ (70 findings: 10 High, 10 Medium, 50 Low). Every finding was triaged against the FastAPI security guidance (https://fastapi.tiangolo.com/tutorial/security/) and the OWASP API Security Top 10.

Result: 0 High, 0 Medium, 0 Low (bandit -r nexy/ -c .bandit exits 0). Every residual risk is an inline # nosec <ID> with a one-line justification: no rule is skipped globally (.bandit sets skips: []) and every # nosec has a matching entry in the register below.

Every # nosec below is intentional and reviewed. Process launches marked "fixed argv" always pass the first argument from shutil.which or a hard-coded tool name, never from untrusted input.

Nexy renders its own Python/TS/HTML source code and server-side HTML, not attacker-controlled HTML documents. Turning autoescape on would double-escape the framework's own emitted HTML props ({{ children }}, {{ toc_html | safe }}) and corrupt code-generation output (env.py, scaffolding files). Dynamic data reaching user templates is the project author's own responsibility and is escaped with |e where needed.

Binding all interfaces is the documented developer convenience default, so a phone or colleague can test on a LAN machine. Production users are expected to set useHost (reverse proxy / 127.0.0.1). Comparison sites are literals, not binds.

nexy/helpers/fs/nexy_format.py names a module constant _TOKEN = "NXFMT{index}Z". Bandit reads the name as a password. It is the pattern of the placeholders the formatter puts in place of Jinja blocks while it formats a .nexy file, and it never leaves the process.

nexy add <url> fetches the component the user explicitly named; the CLI's job is to fetch what the user asks. Scheme restricted to http(s) by the guard above (done during the audit), so no file:///ftp:// readback.

Harmless by itself: every import site is followed by argv-array launches triaged under B603. Sites: modules/cli/commands/{build,check,dev,test,format}.py, utils/common/{process,report}.py, utils/init/{clone,dependencies,template_setup}.py, utils/server/server.py (import + Popen type-only import).

Every flagged call launches an explicit argv array (never a shell string), with the first element pinned to shutil.which(...) or a fixed tool name. What reaches argv:

• Tool checks (check.py, test.py, format.py, build.py): the tool name is resolved on PATH; arguments come from the project layout or the user's own CLI flags. A developer passing hostile flags to nexy check on their own machine is out of threat model.
• Dependency install (utils/init/dependencies.py): package list is the registry-known name set.
• Git scaffold (utils/init/clone.py, init_git in template_setup.py): fixed verbs (init, fetch, checkout, merge); the only interpolated value is the repo URL / subpath the user chose.
• Dev server spawner (utils/server/server.py): sys.executable with a launcher built from resolved config values, or the devtool argv returned by _detect_pm.

To re-run the audit: python -m bandit -r nexy/ -c .bandit

CI audits the full lock envelope (uv export --frozen + pip-audit --disable-pip --strict). Known vulnerabilities must be fixed (bump the package) or, when there is no fixed release, ignored per ID with a written justification here - never with a blanket --ignore-vulns all.