Reporting a security problem in Kview
If you find a security problem in Kview, email [email protected]. We will acknowledge your report.
In scope
- The latest version of the Kview app for macOS
- The Kview pages on korovin.ai: sign-in, account, terms and privacy
- downloads.korovin.ai and Kview's update feed
- The Kview account service
Out of scope
- Problems in our providers' own services (Supabase, Cloudflare, Google, GitHub, Resend, DigitalOcean, MongoDB): please report those to them
- Problems in websites you open inside Kview, unless Kview makes them worse
- Denial of service, spam, social engineering and physical attacks
- Missing best-practice settings without a demonstrated impact
What we ask of you
- Tell us the Kview version, the steps to reproduce, and the impact.
- Test only with your own accounts and data. Do not access, change or delete anyone else's data, and do not degrade the service for others.
- Give us 90 days, or until a fix ships, before you disclose publicly.
What we do
We acknowledge reports, keep you informed where we can, fix problems according to severity, and credit you publicly if you want us to. There is no paid bug bounty during the beta.
If you research and report in good faith and follow this policy, we will not take legal action against you over that research. This promise covers only us, not our providers or anyone else.