Nexgent AI Security Policy

Overview

Nexgent is an open-source, self-hosted trading engine that manages wallets and executes trades on the Solana blockchain. Security issues in the software can lead to real financial loss, so we welcome responsible disclosure from researchers and users.

The SECURITY.md file in the repository is the authoritative security policy for the software and takes precedence over this page.

1. Scope

This policy covers:

• the Nexgent open-source trading engine source code; and
• the nexgent.ai and docs.nexgent.ai websites.

Nexgent does not operate any hosted trading infrastructure. Deployments of the software are run and secured by their operators, so issues specific to someone else's deployment should be reported to that operator.

2. Reporting a Vulnerability

• Report vulnerabilities privately using the “Report a vulnerability” button on the repository's Security tab.
• For critical issues (such as wallet compromise, unauthorised trade execution, or authentication bypass), also email contact@nexgent.ai.
• Please do not open public GitHub issues for security vulnerabilities.

Helpful reports include:

• the affected version or commit, and the component involved;
• steps to reproduce the issue and its potential impact;
• whether it affects simulation mode, live trading, or both; and
• any suggested fix or mitigation.

Please do not include real private keys, wallet secrets, or other people's personal data in your report.

3. Coordinated Disclosure

• We will acknowledge your report, keep you updated on our progress, and credit you if you wish.
• Please give us a reasonable opportunity to release a fix before disclosing an issue publicly.
• Fixes are published as new releases and documented in the release notes.

We will not pursue action against researchers who act in good faith, follow this policy, avoid harming users or their funds, and only test against deployments they own or are authorised to test.

4. Securing Your Deployment

If you self-host Nexgent, you are responsible for the security of your deployment. At a minimum:

• never commit private keys or secrets to version control, and use your platform's secrets management;
• use separate wallets for testing and live trading, funded only with what you need;
• use strong, unique secrets and rotate API keys you no longer trust;
• give signal integrations API keys restricted to the signals scope;
• restrict CORS origins, database access, and network exposure; and
• keep the software and its dependencies up to date.

See the security documentation for detailed guidance.

Contact

For security matters that cannot be reported through GitHub, please contact us by email.