How to report it
Write to contact@klystor.app starting the subject with [Security], or use the contact form with the subject “Security vulnerability”. To help us, include:
- the Klystor version and system (macOS, Windows or Linux), or the website page concerned;
- the steps to reproduce the problem, and evidence if possible (screenshot, log excerpt);
- the impact you foresee: what an attacker could read, change or delete.
Our commitment
- Acknowledgement within 3 business days, then updates at each step.
- Priority fix, shipped in a signed update; we agree with you on when the details are published.
- Credit in the release notes, if you wish.
- No legal action for research carried out in good faith within the rules below.
Good-faith rules
- Test only on your own computer and your own data.
- Do not access or keep other people's data; stop as soon as the vulnerability is demonstrated.
- Do not disrupt the site: no denial of service, no mass form submissions, no intensive automated scanning.
- Do not publish anything before the fix.
Scope
In scope: the Klystor app (macOS, Windows, Linux), its update system, and the klystor.app website with its forms.
Out of scope: automated tool reports without demonstrated impact, attacks that assume an already compromised computer or physical access, and third-party services (hosting, payment), to be reported to their publishers directly.
What Klystor already does
- Signed updates: every update is checked by the app before it is installed.
- macOS app signed and notarised by Apple.
- SHA-256 checksums published for every file, to verify a download (installation guide).
- Nothing leaves your computer: scanning happens locally, and cleanup goes to the Trash by default.
For automated tools, this information is also available in the standard format: security.txt.