Security
How Nocturne protects your account, and how to reach us if you find a problem.
Reporting a vulnerability
If you believe you've found a security issue in Nocturne, email hello@stay-nocturne.com with steps to reproduce it. Please report privately and give us a reasonable window to investigate and ship a fix before any public disclosure — we don't currently run a paid bug bounty, but we credit reporters who ask to be acknowledged. Machine-readable reporting details also live at /.well-known/security.txt (RFC 9116).
How we protect your data
Every member's account is isolated at the database layer: row-level security policies scope every read and write to data you actually have access to, so one member's information can't leak into another's view even if application code has a bug. Optional TOTP two-factor authentication gates sign-in with a hardware-independent second factor, enforced server-side rather than only in the UI. Security-relevant activity — role changes, member removal, and other account-level changes — is recorded to an append-only audit trail that no application code path can edit or delete.