Security

Novus is a free browser tool. The single most important consequence for your security is that the work happens on your device: your audio, your project document and your rendered video are produced locally. This page describes what protects the parts that do touch a server, states the limits honestly, and tells you how to report a problem.

Response headers on every request

These are read from the same module the server configuration builds its rules from, so the table cannot describe a policy the site is not actually sending.

Header	Value	What it does for you
X-Content-Type-Options	nosniff	Browsers must honour the declared content type instead of guessing it, so a file that claims to be an image can never be executed as a script.
Referrer-Policy	strict-origin-when-cross-origin	Links out of Novus carry only the origin, never the full path. A site you click through to cannot see which project or template page you came from.
X-Frame-Options	DENY	No other site may embed Novus in a frame, which is what stops an attacker overlaying an invisible copy of the editor to capture your clicks.
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()	Camera, microphone, location, payment, USB and interest-based ad topics are switched off at the platform level. Microphone visualization is not a shipped feature; if it ever ships this entry has to change first.
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload	The site is HTTPS-only for two years from your last visit, across every Novus subdomain, and is submitted to the browser preload list so even a first visit cannot be downgraded.

A Content-Security-Policy is sent alongside them. It is the mechanism behind the two route lists below.

Routes with no advertising surface

Novus is free because marketing pages carry ads. The workspaces and every account surface are served a stricter Content-Security-Policy in which no advertising or ad-measurement origin is reachable at all, enforced by your browser from the response header, not by a script that politely declines to load.

/editor
/studio
/dashboard
/settings
/admin
/login
/signup
/recover
/notifications
/community/publish

Cross-origin isolated routes

The editors run under cross-origin isolation, which is the strictest process-separation the web platform offers: no cross-origin resource can enter the document unless it opts in. It is required for the threaded in-browser machine-learning runtime, and the isolation is the point rather than a side effect.

/editor
/studio

How the rest is protected

Your audio never leaves your browser

Analysis, rendering and video export all run on your machine through the Web Audio API, WebGL/Canvas and WebCodecs. There is no upload step in the render path, so there is no server-side copy of your track to leak. Transcription and vocal isolation download the model to your browser and run it locally too, so the audio is not sent to an inference service.

src/lib/audio/, src/lib/engines/v3/runtime/, src/lib/whisper.ts, src/lib/ml/demucs.ts

Passwords are never the whole story for sensitive actions

Accounts use Better Auth with optional passkeys. Changing security settings and every administrative action require a fresh verified passkey on top of an already valid session, and each one writes an immutable audit event. Account recovery uses a passkey, a single-use hashed recovery code, or an existing trusted session. Novus does not send account email, so there is no reset link to intercept.

src/lib/auth/, src/app/admin/

Every read and write rechecks who you are

Application data access goes through server-only data-access modules. Projects, assets, community posts, profiles, notifications and admin operations each re-verify the session and the relevant ownership, visibility, suspension or role boundary on every call rather than trusting a check made earlier in the request. Mutation routes additionally require an exact trusted origin.

src/lib/db/, src/app/api/

Uploads are validated after they land, not just before

Client upload tokens are short-lived, scoped to an authenticated owner and a random object path, and bounded by declared type and size. What arrives is then checked by magic bytes and a real decode; SVG and 3D model inputs get format-specific sanitisation, and anything unparsable or incomplete is quarantined rather than served. Community pages serve only a separate public-preview derivative, never the private source object.

src/app/api/assets/, src/lib/assets/

Concurrent edits cannot silently overwrite each other

Project writes carry a revision token. A save built from a stale copy of the document is rejected instead of quietly replacing newer work, which is the difference between a merge conflict and lost work.

src/app/api/projects/

Known limits

Novus has not had an external penetration test or a third-party security audit. Nothing here is a certification.
There is no paid bug bounty. Reports are still welcome and are treated as defects.
Two upstream dependency advisories have no published fix and are accepted with documented mitigations (image decoding is bounded and quarantined; the affected archive loader is never reachable from uploaded content). They are re-checked on every dependency update; see docs/SECURITY.md for the current ledger.
Rate limiting for sign-up, recovery and suspicious sign-in traffic is a deployment-time control configured outside this codebase. Nothing in the application enforces it, and no automated test covers it, so it is listed here as a limit rather than as a feature.
Exported video is written by your browser and is not scanned or signed. What you export is what you rendered.

Reporting a vulnerability

Email visualizers@novusstreamsolutions.com with the affected URL, the steps to reproduce, and what an attacker would gain. You will get an acknowledgement within 5 working days.

Please do not post exploit details to the community feed or any public issue tracker before we have replied.
Test only against your own account and your own uploads. Do not access, modify or retain another person’s data.
No automated scanning that degrades the service for other people, and no social engineering of anyone.
Good-faith research that stays inside those lines will not be met with a legal complaint.

Related: Privacy · Cookies · Accessibility · System status