Version attack-2026-10

NOX Intelligence attack-evidence terms, version attack-2026-10

Contributing attack evidence is optional and off by default. It needs an
organisation token (NOX_INTEL_TOKEN) and --contribute on the command, and these
terms accepted on this machine.

Unlike a scan contribution, this is ATTRIBUTED. The service authenticates your
organisation and records the evidence against it (as a one-way pseudonym in the
shared record; never the organisation name). Two seats of one organisation are
one source.

What is sent, per executed run
  Only the fields printed by "nox intel allowlist --attack": the candidate
  fingerprint you name, the exploitability state the run reached, the kind of
  evidence, whether a deterministic oracle decided it, whether it
  reproduced, whether the benign control was sound, the samples/hits tally, the safety profile, a SHA-256 digest of
  the trace, the nox version and a timestamp.

What is never sent
  The target URL, host or IP address, the route, field names, payloads, the
  target's responses, canary values, file paths, source code, secrets, prompts,
  or the trace itself. The digest is one-way: only you can show which trace it
  was.

What the service does with it
  It stores the report against your organisation, shows an operator how many
  attested reporters reproduced a violation, and may raise YOUR organisation's
  own exposure view. It does not verify the run, does not treat it as evidence
  for anyone else, and it can never make a vulnerability CONFIRMED: a report is
  one organisation's account of its own system.

How to erase
  "nox intel forget --attested" (with NOX_INTEL_TOKEN) removes your
  organisation's contributions from the service. Withdraw here, without
  contacting the service, with "nox intel consent attack withdraw".

If these terms change, attack contribution pauses until you accept the new
version.