Reporting a vulnerability

We welcome reports from security researchers. If you have found a vulnerability in kinnita.com, My Kinnita (api.kinnita.com), our mail servers or the Kinnita Seal plugin, please tell us — we will work with you to fix it quickly.

How to report

• E-mail security@kinnita.com. If the details are sensitive, encrypt them with our PGP key, fingerprint 9C44 A0B2 A96F 3F82 AB5E A6B6 A31A A57D 0BAC C660.
• Describe the issue, the steps to reproduce it and its impact. Screenshots or a short proof of concept help.
• Write in English, Estonian or Russian.

What we promise

• We confirm your report within 2 working days and tell you what happens next.
• We keep you informed until it is fixed, and we fix critical issues as fast as we can.
• With your permission, we thank you publicly once it is fixed.
• We will not take legal action against research done in good faith under these rules.

Please

• Test only accounts and data that are yours, and stop as soon as you reach anyone else's data.
• Do not disrupt the service: no denial-of-service, no spam, no automated scanning that loads our servers.
• No social engineering of our staff or customers, and no physical attacks.
• Give us reasonable time to fix the issue before you tell anyone else.

Not in scope

Missing best practices without a real impact (for example, visible software versions), and findings in services we do not control — Paddle, Google, Cloudflare: please report those to them. We do not run a paid bug bounty yet. Our security.txt is signed with the same key.