Security
Security and trust boundaries
NITY0X is designed around scoped authentication, hashed API keys, idempotent writes, signed webhooks, SSRF protections, and signer isolation. This is not a claim of third-party audit, licensing, or risk-free operation.
API access
Bearer API keys are stored as SHA-256 digests and public API routes enforce permission checks.
Webhook handling
Webhook secrets are encrypted at rest and delivery uses timestamped HMAC signatures.
Payments
Payment and payout transitions use explicit state machines and audit evidence.
Disclosure
Report security issues through the project security contact or repository disclosure path before public release.