NEXUSVAULT is engineered with a client-side Zero-Knowledge design:

1. Client-Side Cryptography Only: Password generation, Shannon entropy calculations, character analysis, and vault storage execute entirely on the user's browser device.
2. Privacy-Preserving Breach Queries: When scanning passwords for breaches, only the first 5 hex characters of the SHA-1 hash are queried against the HaveIBeenPwned API (k-Anonymity). The full plaintext password is never sent over any network socket.
3. Volatile Secure Clipboard: Copied credentials reside in system memory only for a user-specified duration (default: 30 seconds) before being automatically erased.

If you discover a security vulnerability or cryptographic weakness in NEXUSVAULT, please follow responsible disclosure guidelines:

• Do NOT open a public GitHub issue for undisclosed security vulnerabilities.
• Please email your security report directly to the repository maintainer with:
  • Description of the vulnerability
  • Proof of concept or reproduction steps
  • Estimated impact and affected browser/platform versions

We will acknowledge receipt within 24 hours and provide a patch timeline.