S1SECURITY & RESPONSIBLE DISCLOSURE
Security with explicit boundaries.
KTIMIO applies session ownership, prepared queries, upload signature validation, object isolation, rate limits, no-store responses and audit records.
Controls in place today
Private cases and uploads are scoped to the session that created them. Uploads use randomized object keys, SHA-256 hashes, MIME and magic-byte validation, a 10 MB limit and a 30-day retention marker. API writes use input caps, bound SQL parameters, rate limits and same-origin checks for browser forms. Shared reports use hashed, revocable tokens that expire after seven days. Private routes are noindex and exports are sent with no-store.
Known limitations
KTIMIO has not yet completed an independent penetration test, an external malware-scanning integration, verified off-site backups or a 24/7 incident rota. A retention marker is not proof of an executed deletion job. Do not upload sensitive third-party documents without a lawful basis and authorization.
Responsible disclosure
Do not perform destructive testing or attempt to access another user’s data. Report the affected route, reproduction steps and likely impact through the partner form with SECURITY in the subject. There is no bug-bounty programme at this stage.
Incident process
The operating sequence is: contain the affected write or route, preserve request IDs and evidence, identify affected records, rotate or revoke exposed secrets, notify affected people or regulators when required, and document remediation plus regression coverage. The public status route reports technical readiness without disclosing secret values.