Security Policy

We take the security of NSS Background Remover seriously. Because the tool processes images entirely in your browser, the attack surface is narrower than typical web applications — there is no image upload server, public account system, or user-media database. A separate internal operator route can be protected by an environment-backed token and short-lived HttpOnly cookie; it accepts no visitor media. The static hosting, CDN, service worker, internal guard, and client-side code all warrant careful attention.

The machine-readable version of this policy is also available at /.well-known/security.txt.

Reporting a vulnerability

If you believe you have found a security vulnerability in NSS Background Remover, please report it to us by email:

Please include as much detail as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce or proof-of-concept code
• The URL or component affected
• Your contact information (optional, but helpful for follow-up)

We aim to acknowledge all security reports within 48 hours and to provide an initial assessment within 5 business days.

Scope

The following are in scope:

• bgremover.novusstreamsolutions.com and all subpaths
• The service worker and caching behaviour
• Content Security Policy bypass
• Cross-site scripting (XSS)
• Any vulnerability that could affect user privacy or data integrity

The following are out of scope:

• Social engineering attacks targeting our staff
• Physical security
• Denial of service (DoS/DDoS) attacks
• Reports from automated scanners without manual validation
• Third-party services (Vercel infrastructure, Hugging Face CDN) — please report those to the respective vendors
• Vulnerabilities requiring a compromised device or browser

Our commitments

• We will not pursue legal action against researchers acting in good faith under this policy.
• We will acknowledge your report promptly and keep you informed of our progress.
• We will credit you in our security changelog (if you wish) when a valid vulnerability is resolved.
• We ask that you not disclose publicly until we have had a reasonable opportunity to address the issue — typically 90 days.

Security design principles

• No image upload: Images are processed on-device. There is no server endpoint that accepts image data.
• Content Security Policy: An enforcing Content-Security-Policy header — not Report-Only — is served on every route, restricting script sources, worker sources, frame sources, and connection targets. The two full-screen editors carry a stricter policy whose connect-src allows only this origin, the model download hosts, and Google Analytics — no advertising or other third-party endpoint can be contacted from an editor page. We do not currently operate a CSP violation reporting endpoint, so violations surface only in the browser console.
• COOP/COEP: Cross-Origin Opener Policy and Cross-Origin Embedder Policy are set on the image editor and video editor routes as a cross-origin privacy boundary, preventing third-party resources from loading where private media is processed. The isolation also leaves room for a future multi-threaded WebAssembly runtime; today both media runtimes are single-threaded.
• Model integrity: Curated remote model URLs are pinned to immutable revisions and carry expected SHA-256 values. Managed loaders verify bytes before inference, and the service worker rejects or removes a cached response that does not match the requested digest. This check protects the model files; it does not turn probabilistic model output into a guarantee.
• No secrets in client bundle: All client-side environment variables are prefixed NEXT_PUBLIC_ and contain only non-sensitive public identifiers.

Bug bounty

We do not currently operate a paid bug bounty program. We offer public acknowledgement and our genuine gratitude for valid, responsibly disclosed reports.