NearArc Security Policy

Effective date: 20 October 2026 · Last updated: 21 October 2026

NearArc is a service provided by Zach Jensz (ABN 95 243 396 633), a sole trader based in Victoria, Australia (we, us, our). This Security Policy explains how we protect the NearArc platform, what to do if you think your account has been compromised, how we handle data breaches, and how security researchers can report vulnerabilities to us. It sits alongside our Privacy Policy, which is the main source for how we handle personal information. If this policy and the Privacy Policy ever seem to differ about personal information, the Privacy Policy applies.

At a glance

• We protect NearArc with encryption in transit (HTTPS), access controls, monitoring and logging, and contracts that require our service providers to protect information. No system is completely secure.
• NearArc has no passwords. You sign in with a passkey or a one-time code. We store only your passkey's public key, and we don't keep one-time codes after use.
• Messages are encrypted in transit but not end-to-end encrypted. That's deliberate, so we can find and stop spam, fraud and abuse.
• Think your account has been compromised? Email support@neararc.com.
• If a data breach is likely to cause you serious harm, we'll tell you and the relevant regulators as the law requires.
• Found a vulnerability? Good-faith security research on neararc.com is fair game. Report it to security@neararc.com.
• We don't pay cash bounties. Valid findings earn a place on our Wall of Fame (coming soon) and a security researcher badge (coming soon) on your NearArc profile.

1. Who this policy is for

This policy is for NearArc members and visitors who want to know how we protect the platform, and for security researchers who want to test it. Section 2 to section 4 cover how we protect NearArc and what happens when things go wrong. Section 5 to section 11 are our vulnerability disclosure policy.

NearArc is in invite-only public alpha. We're a one-person operation, so we keep our promises modest and specific. We'd rather tell you exactly what we do than make claims we can't back up.

2. How we protect NearArc

Our Privacy Policy (section 7) describes our security safeguards. In summary:

No system is completely secure, and we can't guarantee absolute security. We don't claim any security certification.

Passkeys, not passwords

NearArc doesn't use passwords, so there's no password for us to store or lose.

• Passkeys. When you create a passkey, your device keeps the private key. We store only the public key. We never receive your private key or any biometric data, such as your fingerprint or face. Your fingerprint or face unlock stays on your device.
• One-time codes. We can send a one-time sign-in code by email or SMS. Codes are not kept after use.

Because sign-in relies on your devices and your email or phone, keep them secure. Use a screen lock, keep your operating system and browser up to date, and protect access to your email account.

Messages

Messages on NearArc are encrypted in transit but are not end-to-end encrypted. This is a deliberate choice. It lets us review messages that are reported, and it will let us scan them automatically once our screening tools are active, to find and stop spam, fraud, harassment and other harmful content, and to investigate reports from members. We are building AI-assisted moderation that will flag messages for a person to review before we take any action. End-to-end encryption would stop us doing this and protecting members from abuse. Don't use NearArc messages to share things like passwords, financial details or government identity numbers. The Privacy Policy (section 3) explains how we use message content.

3. If you think your account has been compromised

Signs of a compromised account include sign-ins or messages you don't recognise, changes to your profile or contact details you didn't make, or one-time codes you didn't ask for.

If you notice any of these:

1. Email support@neararc.com from the email address on your account, if you still can. Put "Account compromise" in the subject line. Tell us what you noticed and when.
2. Secure your email account and phone. Anyone who controls them may be able to request one-time codes.
3. Review and remove passkeys you don't recognise, if you can still sign in.
4. Warn your contacts if messages were sent from your account, and don't act on unexpected requests that seem to come from NearArc members.

We may temporarily restrict the account while we investigate and confirm you're the account holder. We'll never ask you for a one-time code. If someone claiming to be NearArc asks for one, don't share it and tell us.

If you're concerned about someone's safety, including threats made through a compromised account, contact emergency services first: 000 (Australia), 111 (New Zealand) or 911 (Canada and the United States). Then email safety@neararc.com. See the Safety Centre for more.

4. Data breaches

If we become aware of a suspected data breach, we will act quickly to contain it, assess it and reduce the risk of harm.

If a data breach is likely to result in serious harm to you, we will notify you and the relevant regulators as required by law. Depending on where you live, this includes:

• Australia: the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), which involves the Office of the Australian Information Commissioner (OAIC);
• New Zealand: notifiable privacy breaches under the Privacy Act 2020, which involves the Office of the Privacy Commissioner;
• Canada: breaches of security safeguards that create a real risk of significant harm under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws; and
• United States: applicable state data breach notification laws.

Where we notify you, we'll explain what happened, what information was involved, and what you can do to protect yourself. We'll usually contact you by email, and may also use a notice in NearArc.

5. Reporting a vulnerability: our approach

We welcome reports from security researchers and members. If you find a security weakness in NearArc, we want to hear about it so we can fix it and protect our members.

Good-faith security research on NearArc is fair game. If you follow this policy, we will treat your research as authorised, we won't take legal action against you, and we'll work with you to understand and fix the issue (section 9 explains what that means and its limits).

NearArc is invite-only. If you'd like to test parts of NearArc that need an account, email security@neararc.com to request an invite for testing. Tell us briefly who you are and what you'd like to look at.

6. Scope

In scope

• neararc.com, including the NearArc web app (progressive web app) served from it and the NearArc accounts, features and APIs it uses.

If you're unsure whether something is in scope, ask us at security@neararc.com before testing.

Out of scope

The following are not covered by this policy and are not authorised:

• Third-party services, including our content delivery, hosting, email, SMS and moderation providers, and payment providers such as Stripe (when added). Report issues in those services to the provider under its own policy. If you find a NearArc misconfiguration of a third-party service, tell us, but don't test the provider's own systems.
• External event sites that NearArc listings link to or import from.
• Social engineering of anyone, including NearArc members, event organisers, Zach Jensz or our providers. This includes phishing.
• Physical attacks on any person, device, office or data centre.
• Denial of service, including volumetric, load, stress or resource exhaustion testing.
• Spam, including sending unsolicited messages, invitations, coffee chat invites, event RSVPs or one-time codes to other people.
• Automated scanner output without demonstrated security impact, such as missing headers or banners that don't lead to a real exploit.
• Other members' accounts and data. Only test with accounts you own or that we've given you.

7. Rules of engagement

When researching NearArc, you must:

• Use your own test accounts. Create or request accounts you control, and only interact with those accounts. Don't access, change or delete anyone else's account or data.
• Stop if you reach someone else's data. If you access personal information or other data that isn't yours, stop testing straight away, report it to us, and don't copy, keep, use or share it. Delete anything you've already saved once you've sent us your report, and tell us you've done so.
• Do the minimum needed. Use an exploit only to the extent needed to confirm a vulnerability. Don't use it to go further into our systems, keep access, or pivot to other systems.
• Don't harm the service. Don't degrade NearArc for other people, and don't run high-volume automated testing. Keep any automated requests at a low rate.
• Don't leave things behind. Don't install backdoors or persistent access. Remove any test content you create when you're done, unless we ask you to keep it for verification.
• Keep it confidential. Don't share details of the vulnerability with anyone else until we've agreed to disclosure (section 10).
• Don't make demands. Don't ask for payment or anything else in exchange for not disclosing or exploiting a vulnerability.
• Follow the law. Comply with all laws that apply to you, and follow this policy and our Terms of Use except where section 9 says otherwise.

If you're not sure whether something is allowed, ask us first at security@neararc.com.

8. How to report

Email security@neararc.com. This is the best way to report a vulnerability.

Logged-in members can also use the in-app bug report form. It's fine for low-risk issues, but please send sensitive details, such as working exploits, proof-of-concept code or anything that would let someone attack NearArc or its members, by email to security@neararc.com instead. If you use the bug report form, we collect what you include, together with the technical details the form shows you before you send it, such as your browser, device and operating system (see the Privacy Policy).

You can report anonymously, but if you don't give us a way to contact you, we can't ask follow-up questions, tell you when it's fixed, or credit you.

Please write in English if you can.

What to include

• The type of vulnerability and where it is (URL, feature or endpoint).
• Step-by-step instructions to reproduce it.
• What an attacker could do with it, and who would be affected.
• Proof of concept, screenshots or request and response examples, if they help. Redact any data that isn't yours.
• Any test accounts you used.
• Whether you accessed anyone else's data and, if so, confirmation that you've deleted it.
• How you'd like to be credited, if at all.

One clear report is much more helpful than many low-quality ones. Please don't send bulk or automated reports.

9. Authorisation and safe harbour

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability:

• We authorise your research on the in-scope systems in section 6, within the rules in section 7. For the purposes of computer offence laws, such as Part 10.7 of the Criminal Code (Cth) and equivalent laws in Australian states and territories, New Zealand, Canada and the United States, you are accessing NearArc with our permission.
• We won't take legal action against you or ask law enforcement to investigate you for that research.
• We waive the restrictions in our Terms of Use that would otherwise prohibit that research (for example, rules against probing, scanning or circumventing our security), but only to the extent needed for research that follows this policy.
• We'll treat accidental, good-faith breaches of this policy as authorised. Contacting us before you do something this policy doesn't clearly cover will count strongly in your favour.
• If someone else takes action against you over research that followed this policy, we will, on request, confirm that your research was authorised by and consistent with this policy.

Limits of this safe harbour

• We can only authorise access to our own systems. We can't give permission for anyone else's systems or data, including our service providers, payment providers, other members or external event sites. We can't stop third parties, regulators or police from taking action, and we can't promise to defend you or cover your costs if they do.
• Members' data belongs to them, not us. Accessing other members' accounts or data is outside this authorisation (section 7).
• This safe harbour doesn't cover conduct that breaks the rules in section 7 deliberately or in bad faith, such as keeping or using other people's data, extortion, harming the service, or social engineering.
• We can't override the law. This policy doesn't authorise anything that's unlawful regardless of our permission, and it can't stop a court requiring us to disclose information.

We won't share your identity with anyone else without your permission, unless the law requires us to. If a vulnerability affects a third party, we may share non-identifying technical details with them so they can fix it.

10. What happens next

We're a one-person operation, so we can't offer round-the-clock response. We aim to:

• Acknowledge your report as soon as practicable, and within any timeframe the law requires, if you've given us contact details. We're sometimes travelling between cities, so we don't promise a fixed number of days.
• Confirm whether we can reproduce it and agree its severity with you as soon as practicable.
• Keep you updated while we work on a fix, and tell you when it's fixed.
• Ask you to check the fix, if you're willing.

We'll prioritise reports based on their impact on members and their personal information. Reports that put members' data at risk come first.

Coordinated disclosure

We support coordinated disclosure. Please give us a reasonable time to fix the issue before you publish anything about it. By default, we ask you to wait 90 days from your report, or until a fix is released, whichever is earlier. If we need more time, we'll explain why and agree a new date with you. If an issue is being actively exploited, or a fix is quick, we may agree a shorter timeframe.

When you publish, please don't include other people's personal information or details that would let someone attack NearArc members before they're protected. We're happy to review a draft and suggest corrections. Where it's useful to members, we may publish our own short summary of a fixed issue, and we'll credit you if you'd like.

11. Recognition

We don't pay cash bounties. What we offer is better, by some definitions: clout.

For valid, in-scope findings that we confirm and fix, you can choose:

• A place on the NearArc Wall of Fame (coming soon), with your name or handle and a link of your choice; and
• A security researcher badge on your NearArc profile (coming soon), so every professional you connect with knows you broke into NearArc (politely, and with permission).

If more than one person reports the same issue, we'll credit the first clear report we receive. We decide whether a finding is valid and in scope. Recognition is optional, and you can ask us to remove your name at any time.

12. Changes to this policy

We may update this policy as NearArc grows, for example when we add payments or new features. We'll publish the current version on neararc.com/policies/security-policy with its effective date. If a change affects research you've already reported or started, the version in place when you started applies to that research.

We also publish a security.txt file at neararc.com/.well-known/security.txt, which points to this policy and our reporting address.

13. Contact us

For vulnerability reports and questions about this policy:

Zach Jensz, responsible officer for security ABN 95 243 396 633 Victoria, Australia Email: security@neararc.com Website: neararc.com

For suspected account compromise or privacy questions, email support@neararc.com. For safety concerns, email safety@neararc.com.

Zach Jensz · ABN 95 243 396 633 · Victoria, Australia · neararc.com