Security. Defended by mathematics.
In production edge routing, security cannot be an afterthought. NexusLB replaces decades of legacy C memory vulnerabilities with modern Rust memory safety, rigorous fuzz testing, and minimal attack surface.
100% Safe Rust Core
Zero manual pointer arithmetic. The Rust type system and borrow checker mathematically eliminate buffer overflow, use-after-free, and data races at compile time.
Hardened TLS 1.3 Dataplane
Native rustls cryptographic backend without OpenSSL C legacy vulnerabilities. Strictly enforces TLS 1.3 and TLS 1.2 with secure modern cipher suites.
Privilege Separation & Sandbox
Runs with minimal Linux capabilities (CAP_NET_BIND_SERVICE). Drops root immediately after binding port 80/443 and supports strict seccomp filtering.
Constant-Time Verifications
JWT HMAC-SHA256 signature verification and API token comparisons use subtle constant-time primitives to resist side-channel timing attacks.
Coordinated Vulnerability Disclosure Process
We welcome security researchers and developers to audit NexusLB. If you discover a potential security vulnerability or memory leakage in the NexusLB codebase, please do not file a public GitHub issue. Instead, disclose it confidentially to our engineering team.
security@nexuslb.devCompiler-Level Mitigations
The NexusLB workspace is compiled with hardened compiler flags:
- Control Flow Integrity & ASLR: Position Independent Executable (PIE) enabled.
- Stack Canaries: Stack overflow detection instrumentation active.
- Panic Abort:
panic = "abort"guarantees that in catastrophic invariants, execution halts immediately with zero stack unwinding corruption. - Strict Clippy & Deny: CI enforces
-D warningsand audits third-party dependency trees withcargo audit.