Krynox is a security product, so we would rather hear about a problem early and imperfectly than late and perfectly. Thank you for taking the time to report one.

Please do not open a public issue, discussion, or pull request for a security problem. Public disclosure before a fix exists puts every site protected by Krynox at risk.

Report it one of two ways:

• GitHub private vulnerability reporting — on any Krynox repository, open the Security tab and choose Report a vulnerability. This keeps the whole conversation private until an advisory is published.
• Email — support@krynox.net with SECURITY in the subject line.

Include whatever you have: what you found, how to reproduce it, and what an attacker could do with it. A proof of concept helps, but do not delay a report to build one.

Never include a secret key (kcps_…) in a report. If you found one exposed, say where it is and we will handle rotation — do not paste the value.

We will keep you updated as the fix progresses, credit you in the advisory if you would like to be named, and let you know when public disclosure happens. If you would rather stay anonymous, that is fine too.

In scope — anything that weakens the protection Krynox provides or exposes data it holds:

• Bypassing proof-of-work, replaying a solved token, or forging a challenge signature.
• Defeating the risk engine, honeypot, or verified-agent and attested-human rails.
• Cross-tenant data exposure, or an authorization flaw in the dashboard or API.
• Vulnerabilities in the published SDKs, framework plugins, or the widget.
• Secrets exposed in a published package, image, or repository.

Out of scope:

• Volumetric denial of service, and load or stress testing against production.
• Findings from an automated scanner with no demonstrated impact.
• Missing hardening headers or a weak TLS cipher with no exploitable consequence.
• Social engineering, physical attacks, or anything targeting Krynox staff.
• Reports against a self-hosted deployment you have misconfigured yourself.

Test against your own account and your own sites. Do not access, modify, or retain another tenant's data — if you stumble into someone else's data, stop and tell us what happened. Use the smallest amount of traffic needed to demonstrate the issue.

Good-faith research that follows this policy is welcome, and we will not pursue legal action over it.

The SDKs and plugins are pre-1.0 and move quickly. Security fixes land on the latest release of each package; please upgrade before reporting an issue you can only reproduce on an older version. The hosted service at krynox.net is always running the current release.