Company
Security
Nox intentionally executes untrusted code, so security is a core product requirement — not a follow-up. This page summarizes how the platform is protected today and how to report issues.
Application security
Secure HTTP-only sessions with short-lived signed cookie cache, 7-day DB sessions, and logout that clears everywhere.
Email verification enforced on signup, password reset over emailed links, domain allowlist and per-IP rate limits on auth.
Role-based access control (USER / MODERATOR / ADMIN / FOUNDER) enforced on the API — never only in the frontend.
Input validation, output encoding, secure headers, and least-privilege secrets handling.
Execution security
User code never runs in the web or API tier. A MongoDB-backed queue hands jobs to separate worker processes, which execute JavaScript and Python in throwaway directories today — container isolation is the hardening milestone on the roadmap.
Never executes user code inside the Next.js app, API process, or database environment.
Workers run in separate processes with throwaway temp directories, wall-clock timeouts, and output caps.
Stripped environment — no app secrets reach the runner. Network disabled by default.
Queue-level concurrency limits plus per-minute run/submit quotas to contain abuse and cost.
Challenge integrity
Hidden tests never leave the server except on admin routes; submissions store only pass/fail per hidden test.
Submissions are immutable and lock the judged challenge version, so later edits cannot rewrite history.
Solved-only solution visibility (403 until you pass) protects challenge integrity.
Rate-limited runs and submissions plus version locking blunt hardcoding and brute-force probing.
Responsible disclosure
Found a vulnerability? Email security@nox.synax.me with steps to reproduce, impact, and any logs. We triage security reports first and will keep you updated as we fix.
Please limit testing to your own account, avoid degrading the service for others, and do not exfiltrate other users' data beyond what is needed to demonstrate the issue. Do not probe the execution sandbox for escape beyond a safe proof of concept.
Scope: Nox.synax.me web app, API, workers, and execution sandbox. Out of scope: third-party providers and social engineering.