Security and Privacy
A factual overview of the safeguards implemented in the current NexFlow repository.
On this page
Credential protection
Credential plaintext is encrypted before database storage with AES-256-GCM using a random 12-byte nonce and authenticated encryption tag. Stored records include a versioned encryption envelope. The UI receives safe metadata and hasSecret, never the encrypted or plaintext secret.
Nodes store credential IDs. At execution time, provider-specific resolvers require the credential ID, current user ID, and expected provider before decrypting the secret. Replacement values are cleared from client state after successful updates.
Ownership and data isolation
Authenticated workflow, credential, execution, settings, realtime, and webhook-management queries scope records to the signed-in user. Workflow saves reject node/connection IDs from another workflow and reject unavailable Telegram or Discord credentials.
Execution history returns user-owned runs and safe result summaries. Full trigger payloads and sensitive node outputs are intentionally excluded from the history response.
Webhook verification
- Telegram registers a generated secret token with Telegram and validates incoming webhook credentials/configuration before queuing.
- Google Forms uses a one-time visible generated secret; only its hash is stored, and the secret must accompany Apps Script requests.
- Discord verifies the Ed25519 signature over Discord's timestamp and raw request body using the credential's Public Key.
- Discord interaction tokens are encrypted at rest and bounded by their interaction-derived expiry time.
- Webhook payload sizes are capped and duplicate event IDs are handled idempotently.
Safe user-visible errors
Execution errors are trimmed, limited in length, and redact common authorization, API-key, token, password, and secret patterns. HTTP response bodies are omitted from execution history. Provider-specific executors convert unknown failures into bounded user-facing messages.
Scope of these guarantees
Warning
The repository does not establish certifications or compliance claims such as SOC 2, ISO 27001, HIPAA, or GDPR certification. Encryption also depends on correct deployment configuration and operational key management. Evaluate the deployment and your own requirements before using sensitive data.