Security at Nova
Nova Content OS treats every account as an isolated workspace. Identity is verified by Firebase Authentication, while Nova issues its own opaque server-side session. Application data is accessed only through authenticated server routes and is explicitly scoped to the verified Firebase UID.
Key safeguards
- Secure, HttpOnly and SameSite application cookies with idle, absolute and rotation limits.
- Same-origin checks and independent authorisation on state-changing routes; browser access to the production database is denied.
- Provider tokens and OAuth session material encrypted on the server with per-record authenticated context and never returned in normal browser state.
- Content Security Policy, frame protection, transport security, restrictive browser permissions and MIME-sniffing protection.
- Persistent rate limits and leases around sensitive and scheduled operations, plus bounded validation for input, files and remote media.
- Official provider APIs, signed webhook verification where supported, and evidence-backed publishing status.
- Secret-aware logging that avoids credentials, raw authentication inputs and payment-card data.
These controls reduce risk but cannot make any internet service invulnerable. Users should protect their email and provider accounts, use unique passwords and disconnect access they no longer need.
Report a vulnerability
Send suspected security vulnerabilities to help@novasagency.com with the subject “Security report”. Include the affected URL, a clear description, reproducible steps, impact and any non-sensitive evidence that helps us investigate. The canonical service origin is https://content.novasagency.com.
Do not include live passwords, private keys, access tokens, personal data belonging to another person or more data than is necessary to show the issue. If you accidentally encounter another user's data, stop, do not copy or alter it, and report the minimum details needed.
Responsible testing boundaries
Please use accounts and content you control. Do not use denial of service, social engineering, phishing, spam, automated high-volume scanning, physical attacks, provider-account compromise or actions that disrupt publishing or access data belonging to others. A report does not create permission to break the law or a promise of reward. We will review good-faith reports and communicate as reasonably practical.
Compromised accounts and privacy incidents
If you believe your Nova account or a connected social account is compromised, change the relevant identity-provider password, revoke the provider grant where appropriate, log out of Nova and contact us. Privacy and deletion requests are handled under the Privacy Policy.