Security.

Last updated August 5, 2026

Reporting a vulnerability

If you believe you have found a security issue in our website or applications, email security@kfdigital.studio. Please include enough detail for us to reproduce it — the affected component, the steps involved, and the impact you believe it has.

Please do not disclose the issue publicly until we have had a reasonable opportunity to address it.

What we commit to

• We will acknowledge your report within three business days.
• We will keep you updated as we investigate.
• We will not pursue legal action against researchers who act in good faith and follow this policy.
• We will credit you when we publish a fix, if you would like us to.

Ground rules

Testing in good faith means:

• Only testing against accounts you own or have explicit permission to test.
• Not accessing, modifying, or deleting other people’s data. If you encounter someone else’s data, stop and tell us.
• No denial-of-service testing, spam, social engineering, or physical attacks against our staff or infrastructure.
• No automated scanning that degrades service for other users.

Out of scope

• Reports from automated scanners without a demonstrated impact.
• Missing security headers with no exploitable consequence.
• Issues requiring physical access to an unlocked device.
• Social engineering of our staff or customers.
• Vulnerabilities in third-party services we do not control.

Rewards

We do not currently operate a paid bug bounty. We do read every report, fix what is real, and credit researchers who help us.

machine-readable policy

This policy is also published at /.well-known/security.txt.