Security

Privacy and the defense against data breaches are Nunya’s first priorities. If you find a problem, we want to hear about it.

Report a problem

• Email [email protected]. Plain email is fine; if you need encryption, say so and we will arrange it.
• Tell us what you found, how to reproduce it, and what you think the impact is. A proof of concept helps; a working exploit is not needed.
• Our machine-readable contact details are at /.well-known/security.txt.
• Anything that is not a security issue, such as a bug or a lost bookmark, goes to [email protected].

What we promise

• Every report is read by a person. We acknowledge within three days and tell you what we found and what we are doing about it.
• We fix confirmed problems before anything else on the roadmap, and we tell users when a fix matters to them.
• We credit you in the fix notes if you want credit, and keep you anonymous if you do not.
• We do not pay bounties. Nunya is a small product and we would rather say so than promise money we cannot pay.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take or support legal action against you for it, and if a third party does, we will say that you acted in accordance with this policy. Good faith means:

• You test only against your own browser, your own data and your own copy of Nunya. You do not access, change or delete anyone else’s data.
• You do not disrupt the website or any future Nunya service for other people.
• You give us a reasonable time to fix the problem before you publish it. Ninety days from your report is our default, and we will ask for more only with a reason.

In scope

• The Nunya browser extension, as installed from the Chrome Web Store or Microsoft Edge Add-ons, including its stored data, its message handling and its backups.
• This website, getnunya.com and getnunya.app.
• The Pro checkout and license check, once they exist. The payment itself is handled by a payment provider under its own security policy.

Out of scope: the browsers themselves, the stores, Google Drive, and anything that needs physical access to an unlocked computer.

What Nunya does to stay safe

• No server, no account, no analytics and no remote code. The extension makes no network requests of its own.
• Minimal permissions at install, and no access to any website. Features that need more ask for it only when you turn them on.
• Every push to the code is scanned for leaked secrets, vulnerable packages and risky code, and the build fails if a permission appears that was not approved.
• Future sync, if you choose it, will be end-to-end encrypted with a recovery code only you hold.