Security Disclosure Policy
How to report security vulnerabilities to KnytX. We prefer private disclosure before public reporting. Contact: security@knytx.com.
Reporting a vulnerability
If you discover a security vulnerability in any KnytX-controlled software or infrastructure, please report it privately before disclosing it publicly.
Contact: security@knytx.com
We will acknowledge your report within 48 hours and provide a resolution timeline within 7 days of triage.
What is in scope
- KnytX mobile apps (Android and iOS) — authentication, data egress, permission misuse, storage of sensitive data, biometric handling
- KnytX backend API — authentication bypasses, privilege escalation, data exposure, injection vulnerabilities
- KnytX web properties — knytx.com and any subdomain handling user data or authentication
- KnytX browser extension (when released)
What is out of scope
- Denial-of-service attacks against production infrastructure
- Social engineering of KnytX employees or contractors
- Physical access attacks
- Findings in third-party services we use (report those to the respective vendor)
- Theoretical vulnerabilities without a proof of concept
- Issues already known to us and tracked in our public issue trackers
Our commitments to researchers
- We will not pursue legal action against researchers who act in good faith under this policy.
- We will acknowledge your contribution in our release notes (or privately, if you prefer).
- We will notify you when the vulnerability is fixed.
- We will not share your identity with third parties without your consent.
Private disclosure preferred
We ask that you give us a reasonable time to fix the issue before public disclosure. Our standard fix window is 90 days from confirmed triage. If you need to disclose sooner for any reason, please let us know and we will work with you on a coordinated timeline.
For critical vulnerabilities actively being exploited, please contact us immediately at security@knytx.com with “CRITICAL” in the subject line.
Scope of this policy
This policy covers all software published at github.com/knytx. Mobile repositories will be published at public launch; see Open Source for the timeline. It also covers all production services operated by NCRYPTO Labs Private Limited under the KnytX brand. Reproducible-build discrepancies — where the published binary does not match the source — are explicitly in scope and treated as critical severity.
PGP Key
To encrypt sensitive vulnerability reports, request our PGP key by emailing security@knytx.com with “PGP KEY REQUEST” in the subject line. The published key and its fingerprint will be available at https://keys.openpgp.org (search security@knytx.com).
Note: If you cannot obtain or verify our key, you may send unencrypted reports — we prefer disclosure over silence.