Vulnerability disclosure

The binding policy is published at kiste.run/security. Its machine-readable form is at kiste.run/.well-known/security.txt. This page repeats it with a little more context.

How to report

Write to luka@lukaloehr.com with the subject Security report, in English or German. Please include:

• what you found and where (URL, API route, CLI command or version),
• how to reproduce it, step by step,
• what an attacker could do with it,
• whether you want to be credited, and under which name.

Please do not put details in public issues or on social media before the issue is fixed.

What we promise

We tell you when it is fixed and credit you if you want. We will not take legal action against research done in good faith under the rules below. There is no paid bug bounty.

Scope

• kiste.run, desktop.kiste.run, docs.kiste.run and the API under kiste.run/v1
• The infrastructure of kiste.stream (not the services customers publish there)
• The kiste CLI and its installer
• Isolation between Kisten, and between a Kiste and the compute server or the control plane

Rules for research

• Use only your own account and your own Kisten. If you need a second account to test isolation between accounts, ask us and we will set one up.
• Do not access, change or delete other people's data. If you reach any by accident, stop, do not keep it, and tell us.
• No denial of service, load tests, spam, social engineering or physical attacks.
• Do not use a Kiste to attack third parties. Remember that outbound port 25 is blocked and that scans are rate-limited (see Network).

How reports are handled

Every report becomes a finding in Kiste's internal security review system. An independent reviewer verifies it, and after the fix a second independent reviewer re-verifies it. A finding is not closed by the person who fixed it.