SECURITY POLICY

Last Updated: July 28, 2026

NOVA Mail takes the security of your data seriously. This document outlines our security practices, architecture, and vulnerability disclosure program.

1. SECURITY ARCHITECTURE

1.1 Encryption at Rest

All email message bodies are encrypted at rest using AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode). Key characteristics:

• Every message receives a unique initialization vector (IV) — no two messages share the same IV, even with the same key
• The encryption key is stored in Cloudflare Secrets, completely isolated from the application layer and database
• The application code never has direct access to the raw encryption key — only the encrypted ciphertext passes through the database
• Message metadata (subject, sender, recipient, timestamp) is not encrypted to enable search and folder organization, but is stored with strict access controls

1.2 Encryption in Transit

• All connections to NOVA Mail use TLS 1.3 (Transport Layer Security)
• Email delivery to external mail servers uses STARTTLS where the receiving server supports it
• We maintain MTA-STS and TLS-RPT records for nova-email.com to enforce TLS on inbound delivery

1.3 Password Security

Property	Specification
Algorithm	PBKDF2-HMAC-SHA-512
Iterations	100,000 (OWASP 2023 recommended minimum: 600,000 for SHA-512)
Salt	128-bit cryptographically random, unique per user
Storage	Hash only — plaintext never written to disk or transmitted after registration

We are reviewing a migration to Argon2id for future iterations.

1.4 Authentication Security

• Brute-force protection: Account lockout after 5 failed attempts within a 5-minute window per IP address
• Rate limiting: 20 outbound messages per 60 seconds per user; 5 login attempts per 5 minutes per IP
• Session tokens: 24-hour expiration, bound to IP address and user agent at issuance
• Session logging: All authentication events logged with IP, user agent, timestamp, and outcome
• Verification codes: 6-digit TOTP-style codes, expire after 10 minutes, one-time use

1.5 API Security

• Rate limiting: Outbound message sending (20/min per user) and login attempts (5/5min per IP) are rate-limited
• Security headers: Every API response includes X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection: 1; mode=block, Referrer-Policy: strict-origin-when-cross-origin
• Input sanitization: All user-generated HTML content passes through a strict sanitizer that strips <script>, <iframe>, <object>, event handlers, and javascript: URLs before rendering
• CORS: Restricted to known origins; no wildcard CORS policies
• Authentication: All API routes require bearer token authentication except public endpoints (login, register)

1.6 Infrastructure Security

Layer	Measure
Network	Cloudflare DDoS protection, WAF, SSL/TLS termination
Compute	Cloudflare Workers — ephemeral, no persistent disk, no shell access
Database	Cloudflare D1 — encrypted at rest, access-controlled via API tokens
Email	Cloudflare Email Routing — DKIM, SPF, DMARC configured
Secrets	Cloudflare Secrets — encryption keys, API tokens, database credentials

2. VULNERABILITY DISCLOSURE PROGRAM

NOVA Mail welcomes security research and responsible disclosure.

2.1 Scope

The following systems are in scope for security research:

• The NOVA Mail web application (nova-email.com and all subdomains)
• The NOVA Mail API endpoints
• The NOVA Mail email infrastructure

2.2 Out of Scope

The following are explicitly out of scope:

• Physical attacks, social engineering, or phishing of NOVA Mail personnel
• Denial of service attacks
• Attacks requiring physical access to a user's device
• Vulnerabilities in third-party services (Cloudflare, GitHub, etc.)
• Previously reported or known vulnerabilities

2.3 Reporting Vulnerabilities

If you discover a security vulnerability, please report it to security@nova-email.com.

Please include:

1. A clear description of the vulnerability
2. Steps to reproduce (including code snippets, if applicable)
3. Potential impact
4. Any suggested remediation

Do NOT:

• Publicly disclose the vulnerability before we have had a chance to address it
• Access, modify, or exfiltrate user data beyond what is necessary to demonstrate the vulnerability
• Use automated scanners without prior authorization

2.4 Our Commitment

When you report a vulnerability:

1. We will acknowledge receipt within 48 hours
2. We will investigate and provide an initial assessment within 5 business days
3. We will work to remediate critical issues within 14 days, high-severity within 30 days
4. We will notify you when the fix is deployed
5. We will credit you in our security acknowledgments (unless you prefer to remain anonymous)

2.5 Safe Harbor

NOVA Mail will not pursue legal action against individuals who:

• Report vulnerabilities in accordance with this policy
• Make a good-faith effort to avoid privacy violations, data destruction, and service interruption
• Do not exploit vulnerabilities beyond what is necessary to demonstrate them

3. INCIDENT RESPONSE

In the event of a confirmed security incident:

1. Detection & Triage: Automated monitoring alerts the security team. Initial assessment within 15 minutes.
2. Containment: Affected systems isolated. Access revoked if credentials compromised.
3. Investigation: Root cause analysis conducted. Forensic data preserved.
4. Notification: Affected users notified within 72 hours (GDPR requirement). Details include: nature of breach, data affected, steps taken.
5. Remediation: Fix deployed. Post-mortem conducted. Security measures improved.

4. ACKNOWLEDGMENTS

NOVA Mail thanks the following security researchers for their contributions:

None yet — be the first.

---

Report vulnerabilities: security@nova-email.com Security inquiries: security@nova-email.com

© 2026 NOVA Mail. All rights reserved.