---
title: NBT Bot security
canonical: https://nbt.bot/security/
---

# NBT Bot security

The public site can show NBT's verification keys without holding the private signing key used for crawler requests.

The production Ed25519 private key is stored as a Cloudflare Worker secret in a dedicated signer Worker. The signer has no public Worker route, no workers.dev URL and no preview URL.

The public site reaches the signer through a private Cloudflare Service binding and exposes only the public Web Bot Auth key directory. The request-signing endpoint is not available on the public internet.

Report vulnerabilities or suspicious NBT traffic to security@nbt.bot. Do not send credentials, customer data, session cookies, merchant signature values or private keys.

RFC 9116: https://nbt.bot/.well-known/security.txt