EN DE

Security

Report a vulnerability.

If you find a vulnerability in nxtgenit.de, NxtFireGuard or Tyvar, please tell us before anyone else.

What you can report.

  • This website, nxtgenit.de
  • NxtFireGuard, meaning nxtfireguard.de, the dashboard, the documentation and the sign-up
  • Tyvar, meaning tyvar.de and the form service behind it

Customer systems are not included. What customers run with us or give us to test is not ours to open up for your research.

How to report.

Send us an email in English or German.

Email

[email protected]

We read every report ourselves.

security.txt

/.well-known/security.txt

The machine-readable file per RFC 9116 lists the contact, languages and a link to this policy.

What a report should contain

  • The affected system and its address
  • A description of the weakness and its impact
  • Steps that let us reproduce it
  • How to reach you if we have questions

Encryption

There is no PGP key for [email protected] yet, so the security.txt has no Encryption field. Once there is a key, we will publish it at /.well-known/pgp-key.txt and on keys.openpgp.org and link it here.

What we ask of you.

  • No disruption of service.

    Please do not run denial of service or load tests, and do not change or delete data.

  • No other people's data.

    Only access other people's data as far as you need it for proof. And keep none of it.

  • No social engineering.

    Please do not send phishing mail or call people to get access.

  • Time before publication.

    Give us time to fix the weakness before you publish it. We agree on the timeframe together.

What you get from us.

  • An acknowledgement as soon as we have read your report
  • Updates on where things stand while we check and fix
  • A public thank-you with your name or handle once the issue is fixed, if you want one

There is no paid bug bounty program.

Safe harbor for good-faith research

If you follow these rules, look only at our own systems and report the weakness to us instead of exploiting it, you are acting in our interest. We take no legal action against good-faith security research like that. We treat your report confidentially. We cannot grant permission for third-party systems, such as those of our hoster or our customers.

Security in NxtFireGuard and Tyvar.

  • NxtFireGuard

    Each sensor signs in to NxtFireGuard with its own auth secret. IPs on your whitelist are never blocked, even if a traffic sensor asks for a block. You set per blocklist how often blocked addresses are scored again, and addresses that are no longer a threat drop off automatically. Your firewalls pull each blocklist over HTTPS from its own URL. How NxtFireGuard works

  • Tyvar

    Before testing, we verify that the targets belong to whoever signs the testing agreement. Working data like scan output, evidence and test accounts is deleted 90 days after the closing call or the retest, or earlier if you ask. The report and the testing agreement are kept for three years. You get the report as an encrypted archive and the password by phone unless we agree otherwise. We never send a report and its password together in one unencrypted message. Data handling on tyvar.de

How this site is secured.

  • Static pages. The pages are built ahead of time and served by Caddy. There is no CMS, database or admin panel.
  • No third-party requests. Fonts, images and scripts come from this domain. We set no cookies, use no analytics and embed nothing from other sites.
  • Strict Content-Security-Policy. default-src 'none', no inline styles and one inline script for the appearance, allowed by its hash.
  • Security headers. Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin policies and X-Frame-Options.
  • TLS 1.2 and 1.3, certificates from Let's Encrypt, hosting at Hetzner in Germany.
  • Server logs are deleted after seven days.