Week in Space Data, every Friday.
What we do today to protect your account and your data, what we do not do yet, and how to report a security problem.
Everything on this page is something our code or our build pipeline actually does. If we add a protection, we add it here; if a claim stops being true, it comes off.
Every page and API call is served over HTTPS. A Strict-Transport-Security header (two years, including subdomains) tells browsers never to connect to spacenexus.us over plain HTTP.
Passwords are hashed with bcrypt and never stored or emailed in plain text. Sign-in attempts are rate limited per IP and per account, and changing your password signs out your other sessions.
Payments are handled by Stripe. Card numbers go to Stripe directly and never reach our servers.
A Content Security Policy, X-Frame-Options and X-Content-Type-Options headers on pages, plus an origin check on signed-in requests that change data, to block cross-site request forgery.
Per-IP rate limits on the API, with tighter limits on sign-in, registration, password reset, checkout and contact forms.
Admin tools require an admin account, and paid data is checked against your plan on the server. Admin actions such as role changes and moderation are written to an audit log with the admin, the time and the IP address.
Every push is scanned for leaked secrets (gitleaks), and the full history is rescanned weekly. Dependency audits and static analysis (Semgrep) run on every push and weekly.
A new release only goes live after its health check passes, and our host restarts the app automatically if it crashes. Automated real-browser checks run against the live site every night and email us when something breaks.
If your organisation needs any of these, tell us: it helps us decide what to build next.
The full details are in our privacy policy.
We welcome reports of security issues in SpaceNexus. If you think you have found one, email us with what you found, the URL or feature involved, the steps to reproduce it and the impact you expect. Please do not include other people's personal data in the report.
We will acknowledge your report within 48 hours, keep you updated while we fix it, and tell you when it is resolved. Please give us reasonable time to fix the issue (we ask for up to 90 days) before you disclose it publicly. We do not run a paid bug bounty, but we are glad to credit you if you would like.
spacenexus.us and its subdomains that we operate. Services we use but do not run (for example our payment, email, hosting and analytics providers) are out of scope: please report issues in them to those providers.
If you research SpaceNexus in good faith and follow these rules, we will not pursue or support legal action against you for that research, and we will treat it as authorised:
If a third party brings legal action over research you did within these rules, we will make it known that your work was authorised. This policy does not let you break the law, and it cannot authorise testing of systems we do not own.
Ask us anything about how SpaceNexus handles security and data. We answer every question ourselves.