Security

NeuroSim is a statically rendered web application with no backend of its own. It has no database, no user accounts, no authentication, no session state, no file uploads, no payment processing and no API that accepts input.

All computation runs in the visitor's browser. There is no server-side execution path that visitor input can reach, because there is no visitor input that reaches a server.

The site collects no personal data, sets no cookies of its own and runs no analytics. Simulation state exists only in browser memory and is discarded when the tab closes. See the privacy policy for detail.

Security response headers are set in the application configuration rather than in platform settings, so they travel with the code to any host: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, and a Permissions-Policy denying camera, microphone, geolocation and interest-cohort access.

Fonts are self-hosted and there are no runtime third-party script or asset requests, so there is no supply-chain surface at page load beyond the application's own bundle.

The dependency footprint is deliberately small: the framework, React, and the type and build tooling. The simulation engine, renderers and experiment harness have no libraries beneath them.

Cross-site scripting or content injection in any page of this site. Issues in the site's response headers or configuration that materially weaken a visitor's security. Vulnerabilities in the published source of the application. Supply-chain issues in a declared dependency that affect this deployment.

Reports that a simulation result is scientifically wrong are welcome, but they belong in general correspondence rather than in a security report.

Denial of service by exhausting your own device's resources. The simulator is designed to let you run it as hard as your hardware allows; making your own browser tab slow is a supported operation, not a vulnerability.

Findings from automated scanners with no demonstrated impact, missing headers with no exploitable consequence on a site with no authentication or personal data, and issues in third-party sites reached by outbound links.

Email contact@alsadaany.com with “NeuroSim security report” in the subject line.

Include the affected URL, a description of the issue, the steps needed to reproduce it, and what an attacker could achieve. A concise proof of concept is worth more than a scanner report.

Please do not publicly disclose an unfixed issue, do not access or modify data belonging to others, and do not degrade the service for other visitors while testing.

NeuroSim is an early-stage product and does not operate a funded security programme or a bug bounty. We will read what you send, act on genuine issues, and credit reporters who want credit.

No response time is guaranteed. Issues with a real impact on visitors are prioritised over everything else on this project.

If you make a good-faith effort to comply with this policy while researching an issue, we will treat your research as authorised, will not pursue action against you for it, and will work with you to understand and resolve the issue.

This statement is an expression of intent by the NeuroSim team at Alsadaany Industries. It is not a legal indemnity and cannot bind third parties, including the hosting provider.