Skip to content
NIGHTZEROS

NightZeros / Security

Security is part of the product.

NightZeros builds developer tools that may run on public websites and handle sensitive configuration. Security decisions are designed into the product rather than treated as an afterthought.

If you believe you have found a vulnerability in a NightZeros project, please report it responsibly.

Report a vulnerabilityDocumentation

Responsible Disclosure

Found a vulnerability? Tell us privately.

Please give us a reasonable opportunity to investigate and fix security issues before making them public.

  1. 01

    Describe the issue

    • affected project
    • affected version or URL
    • steps to reproduce
    • expected vs actual behavior
  2. 02

    Explain the impact

    • what an attacker could potentially do
    • what data or functionality may be affected
  3. 03

    Include supporting details

    • request/response examples
    • screenshots where useful
    • minimal proof of concept
  4. 04

    Keep it private

    Do not open a public GitHub issue for an unpatched vulnerability.

When Testing

Test responsibly.

  • accessing data that does not belong to them

  • intentionally degrading service availability

  • deleting or modifying other users' data

  • using social engineering

  • attempting physical attacks

  • publishing an unpatched vulnerability before coordinated disclosure

NZ/001 / ChatAI

Security controls for public AI embeds.

ChatAI is designed to be embedded on public websites, so the project includes controls intended to reduce abuse and protect server-side configuration.

  • Domain allowlists

    Restrict where an assistant may be embedded.

  • Widget rate limiting

    Limit request volume at the visitor and assistant level.

  • Bot heuristics

    Detect and reject some obviously automated or abusive traffic patterns.

  • Optional widget signing

    Add request-signing controls for installations that need stronger verification.

  • Encrypted provider secrets

    Provider credentials are stored server-side and encrypted rather than exposed to browser integrations.

  • Audit events

    Sensitive configuration and important operator actions can be recorded for review.

  • Privacy controls

    Conversation persistence and retention can be configured separately from security enforcement.

These controls are designed to reduce avoidable exposure. They do not eliminate all abuse or every possible risk.

Trust Boundary

Secrets stay on the server.

Request pathBrowser → Server
  1. Public websiteBROWSER
  2. ChatAI widget / React packageCLIENT
  3. Public assistant identifierPUBLIC ID
  4. NightZeros / ChatAI serverTRUSTED
  5. Security policyENFORCE
  6. Provider credentialsSECRETS
  7. AI providerEXTERNAL

Provider API keys, encryption keys, billing secrets, and privileged server credentials must never be shipped inside public browser packages.

Public Embeds

Assume the browser is observable.

Anything delivered to the browser should be treated as public. Public assistant IDs and widget configuration are not the same as server credentials.

Safe for browser
  • public assistant identifier
  • widget appearance configuration
  • non-secret client settings
Server only
  • AI provider keys
  • encryption keys
  • database credentials
  • billing secrets
  • privileged API credentials

Privacy

Security without unnecessary content retention.

Operational security and usage controls should not require storing private conversation content when it is not needed.

  • no-store mode

  • configurable retention

  • visitor anonymization

  • conversation export/delete controls

  • audit metadata separated from message content where possible

Read about privacy

Self-hosting

Security changes when you run it yourself.

When you self-host a NightZeros project, infrastructure security becomes a shared responsibility.

You control
  • server patching
  • database access
  • TLS/reverse proxy
  • secrets management
  • backups
  • provider credentials
The project provides
  • application-level controls
  • deployment documentation
  • security settings
  • upgrade guidance
Read the self-hosting guide

Releases

Ship deliberately.

NightZeros uses automated checks and controlled release workflows where available, so changes move through review before they reach users.

  • lint/typecheck/test/build gates

  • controlled releases

  • versioned packages

  • protected publish workflows

  • immutable release versions

  • documented upgrade paths

Policies

Project-specific security information.

Security is ongoing.

No software is completely free from risk. We aim to reduce avoidable exposure, respond to reports responsibly, and keep improving the security of NightZeros projects over time.

Security

Found something? Report it responsibly.

Help us investigate and fix security issues before they affect other users.

View security policyExplore ChatAI