Internal review

No external audit

Nymra has not been audited. No outside security firm or independent reviewer has checked the scan engine, the website or the relay. Everything on this page is internal work, and nothing in these docs means “audited”.

The scan engine

• Open rules. Every rule, threshold and confidence is published in RULES.md in the privacy-scan repository, with a rules version that every result names. The finding pages in these docs are checked against that file when they are built.
• Automated tests. The engine has 132 automated tests that run without network, on prepared explorer answers: the score formula, every detector, the explorer client, the relay’s host rules and complete scans.
• Mutation checks of the engine. npm run mutate breaks the engine on purpose in 104 ways, such as a rule that never fires or a service counted as a person, and runs the tests against each one. A breakage the tests do not catch shows a gap in the tests.
• Real-wallet runs. Scans of known public wallets are run in a headless browser and kept for review.

A separate internal review

Separate from the work on each part, an internal review pass checks work it did not write. It ran a first full round on 15 October 2026 and a regression round on 16 October 2026:

• scans of known public wallets, checked by hand against their public history;
• the website and the Terminal, on a phone and on a desktop;
• every privacy claim against what the site and the engine really do, including the requests to third parties and the response headers;
• these docs against the engine’s code;
• the handling of a seed phrase or private key typed, pasted or dropped into a scan field, in Chromium and in WebKit (Safari’s engine), with JavaScript on and off.

Findings marked as launch blockers have to be fixed before launch.

The website and these docs

• The Terminal has end-to-end tests in Chromium and WebKit, including a check of the Content-Security-Policy on every page and a probe that tries to get a secret past the scan fields.
• These docs are built with checks that fail the build when a page lists a rule the engine does not have, when a link or anchor lands nowhere, or when the house text rules are broken. Every page is loaded in Chromium and WebKit at phone, tablet and desktop width, in a dark and a light theme.
• Mutation checks. The checks themselves are tested by breaking things on purpose, such as a renamed rule or a broken link, to prove that each check fails when it should.

What this does not cover

• No external audit and no formal verification.
• No bug bounty programme.
• The relay’s server can only be checked by Nymra; its code is open, its running copy is not.

Found a problem? Write to security@nymra.si. See Safety for how to report it.