If you believe you've found a security vulnerability in Nimt, email security@nimt.ai with a description of the issue and the steps to reproduce it.
Scope
In scope:
- nimt.ai
- www.nimt.ai
- app.nimt.ai
- api.nimt.ai
- docs.nimt.ai
Out of scope: third-party services we use, denial of service, spam, social engineering, physical attacks, and automated scanner output without a demonstrated security impact, such as missing headers or email DNS settings.
Please
- Act in good faith.
- Don't access, change or delete data that isn't yours beyond what's needed to demonstrate the issue.
- Don't disclose the issue publicly until we've had a reasonable chance to fix it.
Our side
We aim to acknowledge reports within a few business days. We won't take legal action against research done in good faith and within this policy.
We don't run a paid bug bounty, and we may not respond to out-of-scope reports.
We may update this policy at any time. Last updated: 27 Oct 2026.