Security Policy and Responsible Disclosure

Version: 2026-09-30

If you find a security problem in KAA, tell us privately at support@kohvra.com and we will not take legal action against good faith research.

How we protect data

• Passwords are stored only as salted hashes. Sign up codes and invitation tokens are stored hashed.
• All traffic uses HTTPS. The app sends strict security headers and a content security policy.
• Access to production data is limited to named people, and changes to the production database are made manually by the owner, with a backup first.
• Sensitive actions (approvals, role changes, data exports, an admin looking at or changing an account's security) are logged.
• Wrong passwords are slowed down and limited per account and per network. If you are locked out, an admin can unlock your account, send you a reset link, or set a temporary password that you replace with your own at your next sign-in. We email you whenever your password changes. Nobody at KAA can see your password.

Reporting a vulnerability

Email support@kohvra.com with the steps to reproduce and the impact. We aim to confirm receipt within 3 business days and keep you updated until it is fixed.

Please do not access or change other members' data beyond the minimum needed to show the problem, run denial of service or load tests, use social engineering on members or staff, or publish the issue before we fix it or 90 days pass, whichever comes first.

Out of scope

Reports from automated scanners without a working example, missing best practice headers with no real impact, and issues in third party services we use (report those to the provider).

This contact is also published at /.well-known/security.txt.