KeenAuth Vulnerability Disclosure Policy

KeenAuth is provided by the US company that sells KeenAuth (Asindie, Inc.), referred to as "we" or "us" in this policy. We welcome reports from security researchers and the public. If you believe you have found a vulnerability, privacy issue, exposed data or other security problem in KeenAuth, we want to hear from you. This policy explains how to report it, what we expect from you and what you can expect from us.

KeenAuth's systems are operated by our licensor AsindieTR, Ltd., which is also bound by this policy, including the Safe Harbor commitments below.

This reporting channel is always open. It does not depend on any bug bounty campaign.

How to report

• Email [email protected]. Encrypt sensitive details with our OpenPGP key: https://trust.keenauth.com/pgp-key.txt.
• Our security.txt is published at https://<host>/.well-known/security.txt on every host we operate (RFC 9116).
• We read reports in English and Turkish.
• Please include: the affected host, product or SDK version; a description and impact; step-by-step reproduction; a proof of concept; and your name or handle if you would like to be credited.
• Do not send reports through customer support tickets or the community forum.

In scope

• Hosts we operate: keenauth.com, dashboard.keenauth.com, api.keenauth.com, each api.<region>.keenauth.com, each dashboard-api.<region>.keenauth.com, docs.keenauth.com, trust.keenauth.com, and each environment host <slug>.<region>.keenauth.app.
• KeenAuth hosted login, including hosted login pages used by our own first customers.
• KeenAuth SDKs, CLI and MCP server. An insecure default in an SDK is in scope.
• Findings on a customer's custom domain that affect the KeenAuth platform itself. Custom domains do not serve our security.txt; report these platform findings to [email protected].

Out of scope

• ops.keenauth.internal and any other internal staff system.
• The systems of our infrastructure providers. Report those to the provider.
• Our customers' own applications and identity providers, and a customer's misconfiguration of an SDK or of their environment. Report those to the customer.
• The application surfaces of products that use KeenAuth as a customer (for example nSupp, BrieflyUp, MindAI, PostHubify). Their hosted login on KeenAuth is in scope.
• Denial of service and volume or load testing.
• Social engineering of our staff, support or customers, including phishing and phone fraud.
• Physical testing.

Testing rules

• Test only with accounts you created yourself on the Free plan, at most 3 accounts per researcher.
• The environments and end users of other customers are out of scope. The only exception is demonstrating cross-environment access, which you must show using your own accounts only.
• Access the minimum data needed to demonstrate the issue. If you reach anyone else's data, stop immediately, report it to us, delete any local copy and confirm the deletion to us in writing. We will then start our incident and breach notification process.
• Do not degrade the service, destroy data or harm anyone's user experience.
• Do not disclose the issue publicly before the coordinated disclosure date below.
• Do not engage in extortion.

Customers who want to test their own environment follow our customer penetration testing policy (https://trust.keenauth.com/customer-pentest-policy); its rules are the same as the testing rules above.

Our commitments

Coordinated disclosure. By default, you may disclose 90 days after your report or once the fix and our advisory are published, whichever comes first. The period can be extended by up to 30 days by mutual agreement. Advisories are published at https://trust.keenauth.com/advisories. With your consent, we credit you at https://trust.keenauth.com/vdp/acknowledgments.

Safe Harbor

When conducting vulnerability research according to this policy, we consider this research to be:

• Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
• Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
• Exempt from restrictions in our Terms of Service and Acceptable Use Policy that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If a third party initiates legal action against you and you have complied with this policy, we will state in writing that your research was authorized under this policy.

If at any time you are unsure whether your research is consistent with this policy, contact [email protected] before going any further.

Safe harbor applies only to legal claims under our control. This policy does not bind independent third parties, including our infrastructure providers and our customers.

Bug bounty campaigns

We do not run a permanently open bug bounty. We run periodic bounty campaigns: we open each campaign, announce its start and end dates, scope and budget, and researchers register for it in advance. A campaign opens and closes at the announced date and time (UTC). Reports outside a campaign, or from researchers not registered for it, receive no bounty but are handled through this policy with the same commitments. We may, at our discretion, offer thanks or a goodwill reward.

Your data

We process your name, email address and handle only to coordinate your report and to credit you. We keep them for 3 years after the report is closed. Personal data in report attachments is masked during triage, and raw attachments are deleted after 30 days.

OpenPGP key for [email protected] · Fingerprint: 0336 4D65 3B6C AA93 98A6 BE84 5C82 4CF9 48AB 83D6