---
title: "Security | Nexus Observatory"
description: "Report vulnerabilities in observatory.global, its subsites and the open protocol tooling to contact@observatory.global. We read every report…"
url: https://observatory.global/security/
publisher: Nexus Observatory Inc.
updated: 2026-10-28
---

Skip to content

Trust

# Found a flaw? Tell us first.

Report vulnerabilities in observatory.global, its subsites and the open protocol tooling to contact@observatory.global. We read every report, credit researchers who ask to be credited, and fix what is real.

**01** Disclosure

## Report it. We take it from there.

1. **Triage and fix** We confirm severity, fix and tell you when it ships.

### In scope

observatory.global and its subsites, the forms and consent surfaces, and the open protocol tools we publish.

### Rules of engagement

### security.txt

Published at `/.well-known/security.txt` (RFC 9116). Sample:

```
Contact: mailto:contact@observatory.global Expires: 2027-10-27T00:00:00.000Z Preferred-Languages: en, fr Policy: https://observatory.global/security/ Canonical: https://observatory.global/.well-known/security.txt
```

**02** Controls

## Headers set on every page.

Set by the site core security-headers module. The content security policy starts report-only, then enforces once the reports are clean.

| Header | Value | Why |
| --- | --- | --- |
| Content-Security-Policy | default-src 'self'; script-src 'self' + hashes; connect-src 'self'; report-only, then enforce | Only this site's own code runs |
| Strict-Transport-Security | max-age=31536000 | HTTPS only, for a year |
| X-Content-Type-Options | nosniff | Files run only as their declared type |
| Referrer-Policy | strict-origin-when-cross-origin | Other sites see the origin, not the page |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=() | Powerful browser features stay off |
| Cross-Origin-Opener-Policy | same-origin-allow-popups | Other windows cannot reach this one |
| X-Frame-Options | SAMEORIGIN | No framing by other sites |

No third-party script, font or tracker loads on this site: fonts, maps and 3D assets are served from observatory.global. Consent records, form entries and redirects stay in this site's own database; form entries are stored encrypted.

© 2026 Nexus Observatory Inc.

**Open** [Protocol](https://observatory.global/protocol/) · [Atlas](https://observatory.global/observatories/) · [Open science](https://observatory.global/open/) · [Learn](https://observatory.global/learn/) **Company** [About](https://observatory.global/about/) · [Stewardship](https://observatory.global/consortium/)

**Legal** [Privacy](https://observatory.global/legal/privacy/) · [Cookies](https://observatory.global/legal/cookies/) · [Terms](https://observatory.global/legal/terms/) · [Data credits](https://observatory.global/credits/)