Vulnerability disclosure

We welcome good-faith security research that helps protect Kioku users and the decisions and context they keep with us. This policy explains what is in scope, how to report a finding, and what we ask researchers to avoid while testing.

If you follow this policy, make a good-faith effort to avoid privacy violations, and do not disrupt the Service, Jishu Labs LLC will not take legal action against you for the research described in your report.

• The public Kioku web application at kioku.jishulabs.com
• Authentication, authorization and account isolation issues
• Exposure of secrets, decision records, linked context or recall answers
• Server-side request handling, API validation and data access control issues
• Cross-site scripting, cross-site request forgery and injection vulnerabilities

• Denial-of-service testing, load testing or resource exhaustion
• Social engineering, phishing or physical attacks
• Reports based only on missing security headers without a practical exploit
• Automated scanner output without analysis or a reproducible impact path
• Issues in third-party services that do not affect Kioku directly
• Findings that depend on the seeded demo workspace alone, unless they reach real accounts

Email reports to admin@jishulabs.com, or send them through the contact page with the bug report topic. Include enough detail for us to reproduce and triage the issue.

• Affected URL, endpoint or feature
• Steps to reproduce, a proof of concept and the expected impact
• The account email used for testing, if any
• Logs, screenshots or timestamps that help confirm the issue

We acknowledge valid reports, triage them by severity, and share updates as the fix progresses. Please hold off on public disclosure until we have confirmed and fixed the issue, unless we agree otherwise in writing.