Security at KeenAuth
Found a security issue? We want to hear from you.
Our reporting channel is always open. Read how to report, what we expect from researchers and what you can expect from us.
[email protected]Encrypt sensitive details with our OpenPGP key.
The program at a glance
What we commit to, in one table. Each row links to the source.
| Item | Status | Detail |
|---|---|---|
| Reporting channel | Always open | Email [email protected]. The channel does not depend on any bug bounty campaign. |
| Disclosure policy | Published | Scope, testing rules, response times and safe harbor in 8 languages. The English text is binding. |
| Safe harbor | In place | We will not initiate or support legal action for accidental, good-faith violations of the policy. |
| Bug bounty | Periodic campaigns | Each campaign is announced with its dates, scope and budget. Reports outside a campaign get the same commitments. |
| security.txt | Signed | RFC 9116 contact file on every host we operate. The copy on trust.keenauth.com is OpenPGP-signed. |
| Security advisories | Atom feed | Fixed issues with severity, CVSS 4.0 vector and affected versions. |
Compliance
We show a framework as held only when there is a dated audit report or certificate. Until then, each row says where we stand.
- SOC 2Not yet auditedThe audit starts after launch. When the report exists, this row will show its date and auditor.
- ISO/IEC 27001Not certifiedOur controls are designed against ISO/IEC 27001, 27017 and 27018. We do not hold a certificate.
- GDPRDesigned to complyKeenAuth is built under EU law. The data processing agreement and the subprocessor list are published here before launch.
- EU Cyber Resilience ActDesigned to complyVulnerability handling, this disclosure policy and our advisories follow the Cyber Resilience Act's requirements.
Our response commitments
- 2business daysto acknowledge your report
- 5business daysto triage it with a CVSS 4.0 score
- 14daysat most between status updates
- 90daysuntil you may disclose by default
What happens after you report
You report
Email [email protected] with the affected host or version, the impact and the steps to reproduce. Encrypt sensitive details with our OpenPGP key.
We acknowledge and triage
We acknowledge your report within 2 business days and send you a triage result with a CVSS 4.0 score within 5 business days.
We fix and coordinate disclosure
We send you a status update at least every 14 days, fix the issue within the target for its severity and coordinate public disclosure with you.
Resources
- Vulnerability disclosure policyScope, testing rules, our response times and safe harbor.
- Security advisoriesSecurity issues we have fixed, with severity and affected versions. Also available as an Atom feed.
- Security acknowledgmentsResearchers who reported issues to us responsibly, listed with their consent.
- security.txt (RFC 9116)Our machine-readable security contact, signed with our OpenPGP key.
Questions and answers
How do I report a vulnerability?
Email [email protected]. Include the affected host, product or SDK version, the impact, step-by-step reproduction and a proof of concept. Do not use support tickets or the community forum.
Is my research protected?
Research that follows the policy is considered authorized. We will not initiate or support legal action against you for accidental, good-faith violations.
Do you pay bounties?
We do not run a permanently open bug bounty. We run periodic campaigns, announced with dates, scope and budget; researchers register in advance. Reports outside a campaign are handled with the same commitments.
What is out of scope?
Denial of service and load testing, social engineering, physical testing, our infrastructure providers' systems and our customers' own applications. The policy has the full list.
How do I check that our security.txt is authentic?
Download our OpenPGP key, compare its fingerprint with the one on this page and verify the file's signature with gpg --verify.
Which languages can I write in?
English or Turkish.
Encrypt your report
Report a security issue by email to [email protected]. Encrypt sensitive details with our OpenPGP key.
Fingerprint0336 4D65 3B6C AA93 98A6 BE84 5C82 4CF9 48AB 83D6