Version attack-2026-11

NOX Intelligence attack-evidence terms, version attack-2026-11

Contributing attack evidence is optional and off by default. It needs an
organisation token (NOX_INTEL_TOKEN) and --contribute on the command, and these
terms accepted on this machine.

Unlike a scan contribution, this is ATTRIBUTED. The service authenticates your
organisation and records the evidence against it (as a one-way pseudonym in the
shared record; never the organisation name). Two seats of one organisation are
one source.

What is sent, per executed run
  Only the fields printed by "nox intel allowlist --attack": the candidate
  fingerprint you name, the exploitability state the run reached, the kind of
  evidence, whether a deterministic oracle decided it, whether it
  reproduced, whether the benign control was sound, the samples/hits tally, the safety profile, a SHA-256 digest of
  the trace, the nox version and a timestamp.

What is never sent
  The target URL, host or IP address, the route, field names, payloads, the
  target's responses, canary values, file paths, source code, secrets, prompts,
  or the trace itself. The digest is one-way: only you can show which trace it
  was.

What the service does with it
  It stores the report against your organisation, shows an operator how many
  attested reporters reproduced a violation, and may raise YOUR organisation's
  own exposure view. It does not verify the run, does not treat it as evidence
  for anyone else, and it can never make a vulnerability CONFIRMED: a report is
  one organisation's account of its own system.

How to erase
  "nox intel forget --attested" (with NOX_INTEL_TOKEN) removes your
  organisation's contributions from the service. Withdraw here, without
  contacting the service, with "nox intel consent attack withdraw".

Who is responsible
  NOX Intelligence at intel.klarlabs.de is run by Felix Geelhaar
  (klarlabs-studio), who is the controller of what it receives. Write to
  nox@felixgeelhaar.de with questions, or to see what the service holds about
  you (attack evidence is held against your organisation, so say which one).
  The service and its backups run on Hetzner servers in Germany and Finland
  (Helsinki), inside the EU. A self-hosted service
  (scan.intelligence.endpoint) is the responsibility of whoever runs it.

Legal basis and your rights
  Your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time; that does
  not make what was sent before unlawful. You may ask for access to, correction
  of or erasure of your data, and complain to a data protection supervisory
  authority.

These terms are published, unchanged, at https://nox-hq.dev/terms/attack-2026-11

If these terms change, attack contribution pauses until you accept the new
version.