Reporting a security problem

In short: if you think you have found a security problem in KONTROL, please email kontrolapplication@gmail.com. Tell us privately first and give us a reasonable chance to fix it before you share it more widely.

1. How to report

• Email kontrolapplication@gmail.com with "Security" in the subject.
• Say what you found, where, and the steps to reproduce it. A short proof of concept helps. Include the KONTROL version (Settings, or the extension's page in Chrome) and your Chrome version.
• Please do not put details in a public place (an issue, a review, social media) until it is fixed.
• The suggestion box in KONTROL is not a safe place for this: use email.

2. What is in scope

• The KONTROL Chrome extension: for example, a way for a web page to read or change KONTROL's stored data, run something with the extension's permissions, or reach a stored licence key or Anthropic API key.
• KONTROL's own services: the licence service, the suggestion service, and the pages that describe KONTROL (privacy policy, terms, refunds, this page).
• Ways to get a licence you did not pay for, or to use another person's licence key.

3. What is not in scope

• Denial-of-service, load testing, spam, or social engineering of KONTROL's owner or its users.
• Problems in services we do not run (Stripe, Anthropic, ntfy.sh, Resend, Cloudflare, Chrome itself). Please report those to their owners.
• Reports from automated scanners with no demonstrated impact, and missing headers or settings with no practical attack.
• The practice site, which is static and holds nothing.

4. What to expect

• We will reply within 7 days to say we have it, and keep you updated as we look into it.
• We will fix real problems as quickly as we reasonably can, and tell you when it is fixed.
• If you would like credit, we will name you (or your handle) in the release notes. If you would rather stay anonymous, say so.
• KONTROL is a small product and has no paid bug bounty at this time.

5. Doing this safely

Please test only against your own installation and your own data, do not access or change other people's data, and stop as soon as you have shown the problem. If you act in good faith and follow this page, we will not take action against you for the research.

6. Machine-readable version

This page is also published as /.well-known/security.txt.