Server-first public pages
Public marketing pages are designed to render without privileged browser credentials or unnecessary client-side state.
Security
Security is an architectural boundary, not a badge.
Novel aims to keep public surfaces small, explicit and defensible while applying stronger controls around authenticated products and operational systems.
Public-site baseline
Reduce exposed behavior before adding defensive layers.
The public website is intentionally static-first and dependency-light. Security controls should reinforce that small attack surface rather than compensate for unnecessary complexity.
Defensive browser policy
The site applies CSP, HSTS, clickjacking, MIME-sniffing, referrer, permissions and cross-origin security headers.
Dependency discipline
Dependencies are kept deliberately small and should be reviewed before production updates or new integrations.
No public secret exposure
Privileged credentials must stay server-side and must not use NEXT_PUBLIC_ unless the value is intentionally public.
Responsible disclosure
Report suspected vulnerabilities privately.
Please do not publish a suspected security issue in a public issue, discussion, social post or other public channel before Novel has had a reasonable opportunity to investigate.
REPORT / PRIVATE
Include enough detail to reproduce the issue.
- Affected URL, product, component or version
- Reproduction steps and required preconditions
- Observed impact and expected behavior
- Proof-of-concept details needed for validation
Use GitHub private vulnerability reporting or a Security Advisory when that option is available for the repository.
Testing boundaries
Do not create avoidable operational harm while investigating.
Do not access data that is not needed to demonstrate the issue, degrade service availability, persist unauthorized access, perform social engineering, or test third-party systems that Novel does not control.
Good-faith reports should focus on the minimum evidence required to explain the vulnerability and its practical impact.
General business contact