> Documentation index: https://docs.kiste.run/llms.txt, a list of every page in this documentation.

# Vulnerability disclosure

> How to report a security issue in Kiste, what we promise in return, and the rules for good-faith research.

The binding policy is published at **[kiste.run/security](https://kiste.run/security)**. Its
machine-readable form is at
[kiste.run/.well-known/security.txt](https://kiste.run/.well-known/security.txt). This page
repeats it with a little more context.

## How to report

Write to **[luka@lukaloehr.com](mailto:luka@lukaloehr.com?subject=Security%20report)** with the subject `Security report`, in English or German. Please
include:

- what you found and where (URL, API route, CLI command or version),
- how to reproduce it, step by step,
- what an attacker could do with it,
- whether you want to be credited, and under which name.

Please do not put details in public issues or on social media before the issue is fixed.

## What we promise

|  |  |
| --- | --- |
| First answer | within 3 working days |
| Assessment | within 10 working days |
| Fix, critical | within 72 hours |
| Fix, high | within 7 days |
| Fix, medium | within 30 days |
| Publication | we aim for coordinated publication within 90 days at most |

We tell you when it is fixed and credit you if you want. We will not take legal action against
research done in good faith under the rules below. There is no paid bug bounty.

## Scope

- kiste.run, desktop.kiste.run, docs.kiste.run and the API under kiste.run/v1
- The infrastructure of kiste.stream (not the services customers publish there)
- The `kiste` CLI and its installer
- Isolation between Kisten, and between a Kiste and the compute server or the control plane

## Rules for research

- Use only your own account and your own Kisten. If you need a second account to test isolation
  between accounts, ask us and we will set one up.
- Do not access, change or delete other people's data. If you reach any by accident, stop, do not
  keep it, and tell us.
- No denial of service, load tests, spam, social engineering or physical attacks.
- Do not use a Kiste to attack third parties. Remember that outbound port 25 is blocked and that
  scans are rate-limited (see [Network](https://docs.kiste.run/security/network.md)).

## How reports are handled

Every report becomes a finding in Kiste's internal security review system. An independent
reviewer verifies it, and after the fix a second independent reviewer re-verifies it. A finding is
not closed by the person who fixed it.

## Related topics

- [Security and trust](https://docs.kiste.run/security.md)
- [Isolation](https://docs.kiste.run/security/isolation.md)
- [Network](https://docs.kiste.run/security/network.md)
- [Encryption](https://docs.kiste.run/security/encryption.md)
- [Supply chain and updates](https://docs.kiste.run/security/supply-chain.md)
- [Data location](https://docs.kiste.run/security/data-location.md)
- [Subprocessors](https://docs.kiste.run/security/subprocessors.md)
- [Logging and retention](https://docs.kiste.run/security/logging-retention.md)
- [Export and deletion](https://docs.kiste.run/security/account-data.md)
- [Incidents and status](https://docs.kiste.run/security/incidents-status.md)
- [Compliance](https://docs.kiste.run/security/compliance.md)
- Previous: [Incidents and status](https://docs.kiste.run/security/incidents-status.md)
- Next: [Compliance](https://docs.kiste.run/security/compliance.md)