1. Scope
This page describes security reporting for the Nanori website and Nanori products provided by Nanori, at 1201 North Market Street, Wilmington, DE 19801, USA.
You may report a suspected issue affecting the Nanori website, Nanori Lens, Nanori Trace or Nanori Oversight. Customer deployments, customer data and infrastructure operated by third parties remain under their owners’ control. This page does not grant permission to test those systems.
2. Report a concern
Use the website contact form and start your message with “Security report.” Initially provide a short description, the affected product or website page, the version if known, and an email address for follow-up. The general form is for initiating contact, not for uploading sensitive evidence.
Do not send credentials, private keys, production database contents, personal records or a working exploit through the initial form. Ask to agree on a suitable channel before sharing sensitive details. If you already have a customer support channel, use it for urgent deployment incidents and reference any existing case.
3. Information useful for investigation
Once an appropriate channel is agreed, useful information can include:
- Affected product, version, component or URL.
- Expected behavior and what you observed.
- Steps to reproduce in an environment you are authorized to test.
- Potential impact, without accessing additional records to demonstrate it.
- Redacted screenshots or minimal evidence, and any conditions needed to reproduce the issue.
- Whether the issue has already been disclosed to another party.
4. Research boundaries
Limit activity to systems you own or are explicitly authorized to test. Use the least intrusive method that can demonstrate a concern. Stop if you encounter another person’s data or risk disrupting a service.
Do not alter or delete data, retain unnecessary copies, attempt persistence, conduct denial-of-service tests, use social engineering, or access third-party systems without authorization. Discovery of a vulnerability does not provide broader authorization.
This page is not a bug bounty offer, a promise of compensation or a grant of legal safe harbor. Any testing authorization or special handling arrangement must be agreed separately.
5. Coordinated handling
Reports should allow us to review the issue and discuss next steps with the reporter. We may request clarification, reproduction details or a safer way to exchange evidence. Please coordinate any public disclosure so the affected parties have an opportunity to assess and address the issue.
This page does not promise a particular acknowledgment or remediation deadline. Handling depends on impact, reproducibility, affected versions and the relevant service arrangement. Do not rely on the general website form as an emergency response service. Personal information supplied with a report is handled as described in the Privacy Policy and any applicable agreement.
6. Website safeguards and product commitments
The intended live website uses HTTPS hosting on Cloudflare. The contact handler validates input and uses Turnstile verification and request rate limits before sending email through Resend. Service credentials remain on the server; they are not included in the website’s browser code. These controls reduce specific risks but do not guarantee that every attack or delivery failure will be prevented.
Product deployment security, supported configurations, data handling and contractual obligations must be assessed separately for each customer arrangement. This page does not represent a certification, independent audit report, compliance guarantee or service-level agreement.