Please do NOT file a public GitHub issue for security vulnerabilities.

NexLoad handles sensitive data including:

• Social media login cookies (Instagram, Facebook)
• Private vault files (PIN/biometric-protected storage)
• Download history and bookmarks
• Local file system access

1. GitHub Security Advisories (preferred): Report a vulnerability

2. Email: abir2afridi@gmail.com

You will receive a response within 72 hours of your report. We ask that you give us 90 days to address the issue before public disclosure.

• Description of the vulnerability and its impact
• Steps to reproduce (Android version, device model, NexLoad version)
• Proof of concept or exploit code (if applicable)
• Any suggested fixes (optional)

• Authentication bypass (vault PIN, biometric)
• Cookie theft / session hijacking (Instagram, Facebook login)
• Unauthorized file system access
• Data leakage (download history, bookmarks, vault files)
• Remote code execution via extractor input
• Man-in-the-middle attacks on download connections

• Social engineering attacks
• Physical device access attacks
• Vulnerabilities in third-party libraries (report upstream)
• Denial of service attacks on public APIs

We will not pursue legal action against researchers who:

• Follow this disclosure policy
• Make a good faith effort to avoid privacy violations
• Do not destroy or corrupt data
• Do not publicly disclose the vulnerability before we have addressed it

We prefer all communications in English.