Security
Report a vulnerability
If you found a security problem in Nimblio or this website, thank you. Please tell us privately first.
How to report
Email security@nimblio.app. Please include:
- what is affected: the app and its version, the MCP server, the installer, or a page or API address on this site;
- the steps to reproduce it, and what an attacker could do with it;
- how you would like to be credited, if at all.
Don’t use the contact form or public channels for security reports. The same address is listed in our security.txt.
What you can expect
- We confirm we received your report within 3 working days.
- We keep you informed while we investigate and fix it.
- We credit you in the release notes once the fix is out, unless you prefer not to be named.
In scope
- The Nimblio desktop app, its MCP server (
Nimblio.Mcp.exe) and the MSI installer. - This website and its API under
/api/. - The update check and the integrity of downloads.
Out of scope
- Denial of service, load testing and spam.
- Social engineering, phishing, or physical attacks.
- Reports from automated scanners without a demonstrated impact.
- Problems in third-party software, unless Nimblio uses it in an unsafe way.
Research in good faith
We won’t take legal action against research that follows this policy: test only against your own accounts and data, don’t access, change or delete other people’s data, don’t degrade the service for others, and give us reasonable time to fix the problem before you talk about it publicly.
Checking your download
The download page shows the SHA-256 checksum of each installer. Compare it with the file you downloaded before running it.