Security.

Report security issues privately by email to [email protected]. Include the affected URL, a minimal reproduction, and the impact you observed. Reports are acknowledged, investigated, and answered. No bug bounty is offered, and automated scanners that generate large request volumes are not welcome.

Severity is assessed against the affected component and the CVSS score from the vendor or the dependency scanner.

• Dependabot opens grouped pull requests weekly and security alerts immediately. Both are reviewed before merge.
• A full dependency audit (npm audit) runs monthly. The last audit before this page was written reported zero known vulnerabilities.
• The framework is kept on the current patched minor line, so new framework advisories are picked up by routine upgrades rather than emergency migration.

This site has no forms, no accounts, no cookies, and no analytics scripts. The hosting provider and the site keep technical request logs (path, user agent, referrer) for operations. The site uses the referrer field only to count visits that arrive from AI chat surfaces. No personal data is intentionally collected, sold, or shared.

The Android apps published by Kitalon Labs are separate products and are covered by their own documents: Privacy Policy and Terms of Service.

Security contact: [email protected]
Machine-readable policy: security.txt